theory Finalise_R

lemma emptySlot_corres:
  "cap_relation info info' \<Longrightarrow> corres dc (einvs and cte_at slot) (invs' and cte_at' (cte_map slot))
             (empty_slot slot info) (emptySlot (cte_map slot) info')" unfolding emptySlot_def empty_slot_def apply (simp add: case_Null_If) apply (rule corres_guard_imp) apply (rule corres_split_noop_rhs[OF clearUntypedFreeIndex_noop_corres]) apply (rule_tac R="\<lambda>cap. einvs and cte_wp_at ((=) cap) slot" and
                     R'="\<lambda>cte. valid_pspace' and cte_wp_at' ((=) cte) (cte_map slot)" in
                     corres_split[OF get_cap_corres]) defer apply (wp get_cap_wp getCTE_wp')+ apply (simp add: cte_wp_at_ctes_of) apply (wp hoare_vcg_imp_lift clearUntypedFreeIndex_valid_pspace') apply fastforce apply (fastforce simp: cte_wp_at_ctes_of) apply simp apply (rule conjI, clarsimp) defer apply clarsimp apply (rule conjI, clarsimp) apply clarsimp apply (simp only: bind_assoc[symmetric]) apply (rule corres_underlying_split[where r'=dc, OF _ postCapDeletion_corres]) defer apply wpsimp+ apply (rule corres_no_failI) apply (rule no_fail_pre, wp hoare_weak_lift_imp) apply (clarsimp simp: cte_wp_at_ctes_of valid_pspace'_def) apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def) apply (rule conjI, clarsimp) apply (erule (2) valid_dlistEp) apply simp apply clarsimp apply (erule (2) valid_dlistEn) apply simp apply (clarsimp simp: in_monad bind_assoc exec_gets) apply (subgoal_tac "mdb_empty_abs a") prefer 2 apply (rule mdb_empty_abs.intro) apply (rule vmdb_abs.intro) apply fastforce apply (frule mdb_empty_abs'.intro) apply (simp add: mdb_empty_abs'.empty_slot_ext_det_def2 update_cdt_list_def set_cdt_list_def exec_gets set_cdt_def bind_assoc exec_get exec_put set_original_def modify_def del: fun_upd_apply | subst bind_def, simp, simp add: mdb_empty_abs'.empty_slot_ext_det_def2)+ apply (simp add: put_def) apply (simp add: exec_gets exec_get exec_put del: fun_upd_apply | subst bind_def)+ apply (clarsimp simp: state_relation_def) apply (drule updateMDB_the_lot, fastforce simp: pspace_relations_def, fastforce, fastforce) apply (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def
                         valid_mdb'_def valid_mdb_ctes_def) apply (elim conjE) apply (drule (4) updateMDB_the_lot, elim conjE) apply clarsimp apply (drule_tac s'=s''a and c=cap.NullCap in set_cap_not_quite_corres) subgoal by simp subgoal by simp subgoal by simp subgoal by fastforce subgoal by fastforce subgoal by fastforce subgoal by fastforce subgoal by fastforce apply fastforce subgoal by fastforce subgoal by fastforce subgoal by fastforce apply (erule cte_wp_at_weakenE, rule TrueI) apply assumption subgoal by simp subgoal by simp subgoal by simp subgoal by simp apply (rule refl) apply clarsimp apply (drule updateCap_stuff, elim conjE, erule (1) impE) apply clarsimp apply (drule updateMDB_the_lot, force simp: pspace_relations_def, assumption+, simp) apply (rule bexI) prefer 2 apply (simp only: trans_state_update[symmetric]) apply (rule set_cap_trans_state) apply (rule set_cap_revokable_update) apply (erule set_cap_cdt_update) apply clarsimp apply (thin_tac "ctes_of t = s" for t s)+ apply (thin_tac "ksMachineState t = p" for t p)+ apply (thin_tac "ksCurThread t = p" for t p)+ apply (thin_tac "ksReadyQueues t = p" for t p)+ apply (thin_tac "ksSchedulerAction t = p" for t p)+ apply (clarsimp simp: cte_wp_at_ctes_of) apply (case_tac rv') apply (rename_tac s_cap s_node) apply (subgoal_tac "cte_at slot a") prefer 2 apply (fastforce elim: cte_wp_at_weakenE) apply (subgoal_tac "mdb_empty (ctes_of b) (cte_map slot) s_cap s_node") prefer 2 apply (rule mdb_empty.intro) apply (rule mdb_ptr.intro) apply (rule vmdb.intro) subgoal by (simp add: invs'_def valid_state'_def valid_pspace'_def valid_mdb'_def) apply (rule mdb_ptr_axioms.intro) subgoal by simp apply (clarsimp simp: ghost_relation_typ_at set_cap_a_type_inv) apply (simp add: pspace_relations_def) apply (rule conjI) apply (clarsimp simp: data_at_def ghost_relation_typ_at set_cap_a_type_inv) apply (rule conjI) prefer 2 apply (rule conjI) apply (clarsimp simp: cdt_list_relation_def) apply(frule invs_valid_pspace, frule invs_mdb) apply(subgoal_tac "no_mloop (cdt a) \<and> finite_depth (cdt a)") prefer 2 subgoal by(simp add: finite_depth valid_mdb_def) apply(subgoal_tac "valid_mdb_ctes (ctes_of b)") prefer 2 subgoal by(simp add: mdb_empty_def mdb_ptr_def vmdb_def) apply(clarsimp simp: valid_pspace_def) apply(case_tac "cdt a slot") apply(simp add: next_slot_eq[OF mdb_empty_abs'.next_slot_no_parent]) apply(case_tac "next_slot (aa, bb) (cdt_list a) (cdt a)") subgoal by (simp) apply(clarsimp) apply(frule(1) mdb_empty.n_next) apply(clarsimp) apply(erule_tac x=aa in allE, erule_tac x=bb in allE) apply(simp split: if_split_asm) apply(drule cte_map_inj_eq) apply(drule cte_at_next_slot) apply(assumption)+ apply(simp) apply(subgoal_tac "(ab, bc) = slot") prefer 2 apply(drule_tac cte="CTE s_cap s_node" in valid_mdbD2') subgoal by (clarsimp simp: valid_mdb_ctes_def no_0_def) subgoal by (clarsimp simp: invs'_def valid_state'_def valid_pspace'_def) apply(clarsimp) apply(rule cte_map_inj_eq) apply(assumption) apply(drule(3) cte_at_next_slot', assumption) apply(assumption)+ apply(simp) apply(drule_tac p="(aa, bb)" in no_parent_not_next_slot) apply(assumption)+ apply(clarsimp) apply(simp add: next_slot_eq[OF mdb_empty_abs'.next_slot] split del: if_split) apply(case_tac "next_slot (aa, bb) (cdt_list a) (cdt a)") subgoal by (simp) apply(case_tac "(aa, bb) = slot", simp) apply(case_tac "next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot") apply(simp) apply(case_tac "next_slot ac (cdt_list a) (cdt a)", simp) apply(simp) apply(frule(1) mdb_empty.n_next) apply(clarsimp) apply(erule_tac x=aa in allE', erule_tac x=bb in allE) apply(erule_tac x=ac in allE, erule_tac x=bd in allE) apply(clarsimp split: if_split_asm) apply(drule(1) no_self_loop_next) apply(simp) apply(drule_tac cte="CTE cap' node'" in valid_mdbD1') apply(fastforce simp: valid_mdb_ctes_def no_0_def) subgoal by (simp add: valid_mdb'_def) apply(clarsimp) apply(simp) apply(frule(1) mdb_empty.n_next) apply(erule_tac x=aa in allE, erule_tac x=bb in allE) apply(clarsimp split: if_split_asm) apply(drule(1) no_self_loop_prev) apply(clarsimp) apply(drule_tac cte="CTE s_cap s_node" in valid_mdbD2') apply(clarsimp simp: valid_mdb_ctes_def no_0_def) apply clarify apply(clarsimp) apply(drule cte_map_inj_eq) apply(drule(3) cte_at_next_slot') apply(assumption)+ apply(simp) apply(erule disjE) apply(drule cte_map_inj_eq) apply(drule(3) cte_at_next_slot) apply(assumption)+ apply(simp) subgoal by (simp) apply (simp add: revokable_relation_def) apply (clarsimp simp: in_set_cap_cte_at) apply (rule conjI) apply clarsimp apply (drule(1) mdb_empty.n_revokable) subgoal by clarsimp apply clarsimp apply (drule (1) mdb_empty.n_revokable) apply (subgoal_tac "null_filter (caps_of_state a) (aa,bb) \<noteq> None") prefer 2 apply (drule set_cap_caps_of_state_monad) subgoal by (force simp: null_filter_def) apply clarsimp apply (subgoal_tac "cte_at (aa, bb) a") prefer 2 apply (drule null_filter_caps_of_stateD, erule cte_wp_cte_at) apply (drule (2) cte_map_inj_ps, fastforce) subgoal by simp apply (clarsimp simp add: cdt_relation_def) apply (subst mdb_empty_abs.descendants, assumption) apply (subst mdb_empty.descendants, assumption) apply clarsimp apply (frule_tac p="(aa, bb)" in in_set_cap_cte_at) apply clarsimp apply (frule (2) cte_map_inj_ps, fastforce) apply simp apply (case_tac "slot \<in> descendants_of (aa,bb) (cdt a)") apply (subst inj_on_image_set_diff) apply (rule inj_on_descendants_cte_map) apply fastforce apply fastforce apply fastforce apply fastforce apply fastforce subgoal by simp subgoal by simp apply simp apply (subgoal_tac "cte_map slot \<notin> descendants_of' (cte_map (aa,bb)) (ctes_of b)") subgoal by simp apply (erule_tac x=aa in allE, erule allE, erule (1) impE) apply (drule_tac s="cte_map ` u" for u in sym) apply clarsimp apply (drule cte_map_inj_eq, assumption) apply (erule descendants_of_cte_at, fastforce) apply fastforce apply fastforce apply fastforce apply simp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cap_relation info info' \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) slot) (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (empty_slot slot info) (emptySlot (cte_map slot) info') proof (prove)
goal (1 subgoal):
 1. cap_relation info info' \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) slot) (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do cap <- get_cap slot;
if cap = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
parent <- return $ cdt slot;
set_cdt ((\<lambda>p. if cdt p = Some slot then parent else cdt p)(slot := None));
do_extended_op (empty_slot_ext slot slot_p);
set_original slot False;
set_cap cap.NullCap slot;
post_cap_deletion info
od
od) (do clearUntypedFreeIndex (cte_map slot);
newCTE <- getCTE (cte_map slot);
mdbNode <- return (cteMDBNode newCTE);
prev <- return (mdbPrev mdbNode);
next <- return (mdbNext mdbNode);
case cteCap newCTE of capability.NullCap \<Rightarrow> return () | _ \<Rightarrow> do updateMDB prev (mdbNext_update (\<lambda>_. next));
updateMDB next (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged mdbNode) (mdbPrev_update (\<lambda>_. prev) mdb));
updateCap (cte_map slot) capability.NullCap;
updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od
od) proof (prove)
goal (1 subgoal):
 1. cap_relation info info' \<Longrightarrow> corres dc (einvs and cte_wp_at (\<lambda>_. True) slot) (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) (do cap <- get_cap slot;
if cap = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od
od) (do y <- clearUntypedFreeIndex (cte_map slot);
newCTE <- getCTE (cte_map slot);
if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od
od) proof (prove)
goal (3 subgoals):
 1. cap_relation info info' \<Longrightarrow> corres dc ?Q4 ?Q'4 (do cap <- get_cap slot;
if cap = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od
od) (do y <- clearUntypedFreeIndex (cte_map slot);
newCTE <- getCTE (cte_map slot);
if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od
od)
 2. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ?Q4 s
 3. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> ?Q'4 s proof (prove)
goal (4 subgoals):
 1. cap_relation info info' \<Longrightarrow> corres dc ?R8 ?R'8 (do cap <- get_cap slot;
if cap = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od
od) (do newCTE <- getCTE (cte_map slot);
if cteCap newCTE = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode newCTE)) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode newCTE)));
y <- updateMDB (mdbNext (cteMDBNode newCTE)) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode newCTE)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode newCTE)) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od
od)
 2. cap_relation info info' \<Longrightarrow> \<lbrace>?Q'8\<rbrace> clearUntypedFreeIndex (cte_map slot) \<lbrace>\<lambda>x. ?R'8\<rbrace>
 3. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R8) s
 4. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'8) s proof (prove)
goal (6 subgoals):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od)
 2. cap_relation info info' \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_cap slot \<lbrace>\<lambda>cap. einvs and cte_wp_at ((=) cap) slot\<rbrace>
 3. cap_relation info info' \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. valid_pspace' and cte_wp_at' ((=) cte) (cte_map slot)\<rbrace>
 4. cap_relation info info' \<Longrightarrow> \<lbrace>?Q'8\<rbrace> clearUntypedFreeIndex (cte_map slot) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and ?Q'12\<rbrace>
 5. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (cte_wp_at (\<lambda>_. True) slot and ?Q12)) s
 6. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'8) s proof (prove)
goal (6 subgoals):
 1. cap_relation info info' \<Longrightarrow> \<lbrace>?Q12\<rbrace> get_cap slot \<lbrace>\<lambda>cap. einvs and cte_wp_at ((=) cap) slot\<rbrace>
 2. cap_relation info info' \<Longrightarrow> \<lbrace>?Q'12\<rbrace> getCTE (cte_map slot) \<lbrace>\<lambda>cte. valid_pspace' and cte_wp_at' ((=) cte) (cte_map slot)\<rbrace>
 3. cap_relation info info' \<Longrightarrow> \<lbrace>?Q'8\<rbrace> clearUntypedFreeIndex (cte_map slot) \<lbrace>\<lambda>x. pspace_aligned' and pspace_distinct' and ?Q'12\<rbrace>
 4. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (cte_wp_at (\<lambda>_. True) slot and ?Q12)) s
 5. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and ?Q'8) s
 6. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (4 subgoals):
 1. cap_relation info info' \<Longrightarrow> \<lbrace>?P'25\<rbrace> clearUntypedFreeIndex (cte_map slot) \<lbrace>\<lambda>rv s. \<forall>cte. cte_wp_at' ((=) cte) (cte_map slot) s \<longrightarrow> (valid_pspace' and cte_wp_at' ((=) cte) (cte_map slot)) s\<rbrace>
 2. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> (einvs and cte_wp_at ((=) cap) slot) s))) s
 3. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ?P'25 s)) s
 4. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (4 subgoals):
 1. cap_relation info info' \<Longrightarrow> \<lbrace>?P'25\<rbrace> clearUntypedFreeIndex (cte_map slot) \<lbrace>\<lambda>rv s. (\<exists>cte. ctes_of s (cte_map slot) = Some cte) \<longrightarrow> valid_pspace' s\<rbrace>
 2. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> (einvs and cte_wp_at ((=) cap) slot) s))) s
 3. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ?P'25 s)) s
 4. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_relation info info'; (einvs and cte_wp_at (\<lambda>_. True) slot) s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (cte_wp_at (\<lambda>_. True) slot and (\<lambda>s. \<forall>cap. cte_wp_at ((=) cap) slot s \<longrightarrow> (einvs and cte_wp_at ((=) cap) slot) s))) s
 2. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ((\<nexists>cte. ctes_of s (cte_map slot) = Some cte) \<or> valid_pspace' s))) s
 3. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_relation info info'; (invs' and cte_wp_at' (\<lambda>_. True) (cte_map slot)) s\<rbrakk> \<Longrightarrow> (cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> ((\<nexists>cte. ctes_of s (cte_map slot) = Some cte) \<or> valid_pspace' s))) s
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (if rv = cap.NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (if cteCap rv' = capability.NullCap then return () else do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> (rv = cap.NullCap \<longrightarrow> cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) cap.NullCap) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (return ()) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od)) \<and> (rv \<noteq> cap.NullCap \<longrightarrow> (cteCap rv' = capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (return ())) \<and> (cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> (cteCap rv' = capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (return ())) \<and> (cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od)) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv')\<rbrakk> \<Longrightarrow> rv \<noteq> cap.NullCap \<longrightarrow> (cteCap rv' = capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (return ())) \<and> (cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od)) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> (cteCap rv' = capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (return ())) \<and> (cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od)) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap\<rbrakk> \<Longrightarrow> cteCap rv' \<noteq> capability.NullCap \<longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do slot_p <- gets (\<lambda>s. cdt s slot);
cdt <- gets cdt;
y <- set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None));
y <- empty_slot_ext slot slot_p;
y <- set_original slot False;
y <- set_cap cap.NullCap slot;
post_cap_deletion info
od) (do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
y <- updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb));
y <- updateCap (cte_map slot) capability.NullCap;
y <- updateMDB (cte_map slot) (const nullMDBNode);
global.postCapDeletion info'
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do y <- do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od;
post_cap_deletion info
od) (do y <- do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od;
global.postCapDeletion info'
od) proof (prove)
goal (4 subgoals):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) (do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od)
 2. \<And>rv rv' y ya. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; dc y ya\<rbrakk> \<Longrightarrow> cap_relation info info'
 3. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>einvs and cte_wp_at ((=) rv) slot\<rbrace> do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)\<rbrace> do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od \<lbrace>\<lambda>y _. True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>rv rv' y ya. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; dc y ya\<rbrakk> \<Longrightarrow> cap_relation info info'
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>einvs and cte_wp_at ((=) rv) slot\<rbrace> do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od \<lbrace>\<lambda>y _. True\<rbrace>
 3. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<lbrace>valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)\<rbrace> do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od \<lbrace>\<lambda>y _. True\<rbrace>
 4. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) (do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> corres dc (einvs and cte_wp_at ((=) rv) slot) (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) (do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; True\<rbrakk> \<Longrightarrow> no_fail (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) (do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od)
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; True; (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s\<rbrakk> \<Longrightarrow> ((\<lambda>s. mdbPrev (cteMDBNode rv') \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbPrev (cteMDBNode rv')) s) and (\<lambda>s. mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode rv')) s) and cte_wp_at' (\<lambda>_. True) (cte_map slot) and (\<lambda>s. cte_map slot \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map slot) s)) s
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb' s; ctes_of s (cte_map slot) = Some rv'\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode rv')) = Some cte)) \<and> (mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte))
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (mdbPrev (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbPrev (cteMDBNode rv')) = Some cte)) \<and> (mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte))
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbPrev (cteMDBNode rv') \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbPrev (cteMDBNode rv')) = Some cte
 2. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte)
 3. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (3 subgoals):
 1. \<And>rv rv' s cte'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbPrev (cteMDBNode rv') \<noteq> 0; ctes_of s (mdbPrev (cteMDBNode rv')) = Some cte'; mdbNext (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbPrev (cteMDBNode rv')) = Some cte
 2. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte)
 3. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode rv') \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte)
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbNext (cteMDBNode rv') \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' s cte'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; ctes_of s (cte_map slot) = Some rv'; no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); mdbNext (cteMDBNode rv') \<noteq> 0; ctes_of s (mdbNext (cteMDBNode rv')) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map slot\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode rv')) = Some cte
 2. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>rv rv'. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap\<rbrakk> \<Longrightarrow> \<forall>(s, s')\<in>state_relation. (einvs and cte_wp_at ((=) rv) slot) s \<and> (valid_pspace' and cte_wp_at' ((=) rv') (cte_map slot)) s' \<longrightarrow> (\<forall>(r', t')\<in>fst ((do y <- do y <- do y <- updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')));
updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))
od;
updateCap (cte_map slot) capability.NullCap
od;
updateMDB (cte_map slot) (const nullMDBNode)
od) s'). \<exists>(r, t)\<in>fst ((do y <- do y <- do slot_p <- gets (\<lambda>s. cdt s slot);
y <- do cdt <- gets cdt;
set_cdt ((\<lambda>p. if cdt p = Some slot then cdt slot else cdt p)(slot := None))
od;
empty_slot_ext slot slot_p
od;
set_original slot False
od;
set_cap cap.NullCap slot
od) s). (t, t') \<in> state_relation \<and> dc r r') proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b)\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b)\<rbrakk> \<Longrightarrow> mdb_empty_abs a proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b)\<rbrakk> \<Longrightarrow> mdb_empty_abs a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b)\<rbrakk> \<Longrightarrow> vmdb_abs a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b)\<rbrakk> \<Longrightarrow> valid_mdb a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst ((do x <- set_cdt ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None));
x <- empty_slot_ext slot (cdt a slot);
y <- set_original slot False;
set_cap cap.NullCap slot
od) a). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a\<rbrakk> \<Longrightarrow> \<exists>y\<in>fst (put (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)\<rparr>) (a\<lparr>cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)\<rparr>)). \<exists>x\<in>fst (case y of (x, xa) \<Rightarrow> (do x <- gets is_original_cap;
xa <- get;
y <- put (xa\<lparr>is_original_cap := x(slot := False)\<rparr>);
set_cap cap.NullCap slot
od) xa). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a\<rbrakk> \<Longrightarrow> \<exists>(r, t)\<in>fst ((do x <- gets is_original_cap;
xa <- get;
y <- \<lambda>_. ({((), xa\<lparr>is_original_cap := x(slot := False)\<rparr>)}, False);
set_cap cap.NullCap slot
od) (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)\<rparr>)). (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; (a, b) \<in> state_relation; invs a; valid_list a; valid_sched a; cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> (t, ba) \<in> state_relation proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s'') \<in> fst (updateMDB (mdbPrev (cteMDBNode rv')) (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))) b); ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b\<rbrakk> \<Longrightarrow> no_0 (ctes_of b)
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))) \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksInterruptState s'' = ksInterruptState b \<and> ksArchState s'' = ksArchState b \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> pspace_relations (ekheap a) (kheap a) (ksPSpace s'') \<and> pspace_aligned' s'' \<and> pspace_distinct' s'' \<and> no_0 (ctes_of s'') \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx b \<and> ksDomSchedule s'' = ksDomSchedule b \<and> ksCurDomain s'' = ksCurDomain b \<and> ksDomainTime s'' = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))) \<and> ksMachineState s'' = ksMachineState b \<and> ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b \<and> ksCurThread s'' = ksCurThread b \<and> ksIdleThread s'' = ksIdleThread b \<and> ksReadyQueues s'' = ksReadyQueues b \<and> ksSchedulerAction s'' = ksSchedulerAction b \<and> ksInterruptState s'' = ksInterruptState b \<and> ksArchState s'' = ksArchState b \<and> gsUserPages s'' = gsUserPages b \<and> gsCNodes s'' = gsCNodes b \<and> pspace_relations (ekheap a) (kheap a) (ksPSpace s'') \<and> pspace_aligned' s'' \<and> pspace_distinct' s'' \<and> no_0 (ctes_of s'') \<and> ksDomScheduleIdx s'' = ksDomScheduleIdx b \<and> ksDomSchedule s'' = ksDomSchedule b \<and> ksCurDomain s'' = ksCurDomain b \<and> ksDomainTime s'' = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''a) \<in> fst (updateMDB (mdbNext (cteMDBNode rv')) (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)) s''); ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of s''); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of s''); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (ctes_of s'') (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState s''; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted s''; ksCurThread s''a = ksCurThread s''; ksIdleThread s''a = ksIdleThread s''; ksReadyQueues s''a = ksReadyQueues s''; ksSchedulerAction s''a = ksSchedulerAction s''; ksInterruptState s''a = ksInterruptState s''; ksArchState s''a = ksArchState s''; gsUserPages s''a = gsUserPages s''; gsCNodes s''a = gsCNodes s''; pspace_relations (ekheap a) (kheap a) (ksPSpace s''a); pspace_aligned' s''a; pspace_distinct' s''a; no_0 (ctes_of s''a); ksDomScheduleIdx s''a = ksDomScheduleIdx s''; ksDomSchedule s''a = ksDomSchedule s''; ksCurDomain s''a = ksCurDomain s''; ksDomainTime s''a = ksDomainTime s''\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''a); pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (20 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_thread a = ksCurThread s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> idle_thread a = ksIdleThread s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> machine_state a = ksMachineState s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> work_units_completed a = ksWorkUnitsCompleted s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_index a = ksDomScheduleIdx s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
A total of 20 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> cur_thread a_ = ksCurThread s''a_ proof (prove)
goal (19 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> idle_thread a = ksIdleThread s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> machine_state a = ksMachineState s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> work_units_completed a = ksWorkUnitsCompleted s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_index a = ksDomScheduleIdx s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
A total of 19 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> idle_thread a_ = ksIdleThread s''a_ proof (prove)
goal (18 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> machine_state a = ksMachineState s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> work_units_completed a = ksWorkUnitsCompleted s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_index a = ksDomScheduleIdx s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
A total of 18 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> machine_state a_ = ksMachineState s''a_ proof (prove)
goal (17 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> work_units_completed a = ksWorkUnitsCompleted s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_index a = ksDomScheduleIdx s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
A total of 17 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> work_units_completed a_ = ksWorkUnitsCompleted s''a_ proof (prove)
goal (16 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_index a = ksDomScheduleIdx s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
A total of 16 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> domain_index a_ = ksDomScheduleIdx s''a_ proof (prove)
goal (15 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_list a = ksDomSchedule s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
A total of 15 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> domain_list a_ = ksDomSchedule s''a_ proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cur_domain a = ksCurDomain s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
A total of 14 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> cur_domain a_ = ksCurDomain s''a_ proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> domain_time a = ksDomainTime s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
A total of 13 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> domain_time a_ = ksDomainTime s''a_ proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (?x294 rv rv' a b ba s'' s''a s''b, ?t'294 rv rv' a b ba s'' s''a s''b) \<in> fst (updateCap (?p'294 rv rv' a b ba s'' s''a s''b) (?c'294 rv rv' a b ba s'' s''a s''b) s''a)
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap (?c'294 rv rv' a b ba s'' s''a s''b)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map (?p294 rv rv' a b ba s'' s''a s''b)
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> valid_objs a_ proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map (?p294 rv rv' a b ba s'' s''a s''b)
 10. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap (?p294 rv rv' a b ba s'' s''a s''b) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> pspace_aligned a_ proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map (?p294 rv rv' a b ba s'' s''a s''b)
 9. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap (?p294 rv rv' a b ba s'' s''a s''b) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> pspace_distinct a_ proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (?p294 rv rv' a b ba s'' s''a s''b) a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map (?p294 rv rv' a b ba s'' s''a s''b)
 8. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap (?p294 rv rv' a b ba s'' s''a s''b) a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_aligned' s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 7. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> pspace_distinct' s''a
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 6. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> pspace_distinct' s''a_ proof (prove)
goal (5 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState s''a)
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 5. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState s''a_) proof (prove)
goal (4 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> (arch_state a, ksArchState s''a) \<in> arch_state_relation
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 4. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> (arch_state a_, ksArchState s''a_) \<in> arch_state_relation proof (prove)
goal (3 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 3. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; cte_wp_at' ((=) rv'_) (cte_map slot) b_; ((), s''b_) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a_); ((), ba_) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ctes_of s''_ = modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_)))); ksMachineState s''_ = ksMachineState b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksCurThread s''_ = ksCurThread b_; ksIdleThread s''_ = ksIdleThread b_; ksReadyQueues s''_ = ksReadyQueues b_; ksSchedulerAction s''_ = ksSchedulerAction b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ctes_of s''a_ = modify_map (modify_map (ctes_of b_) (mdbPrev (cteMDBNode rv'_)) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'_))))) (mdbNext (cteMDBNode rv'_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv'_)) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv'_)) mdb))); ksMachineState s''a_ = ksMachineState b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksCurThread s''a_ = ksCurThread b_; ksIdleThread s''a_ = ksIdleThread b_; ksReadyQueues s''a_ = ksReadyQueues b_; ksSchedulerAction s''a_ = ksSchedulerAction b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_\<rbrakk> \<Longrightarrow> cap_relation cap.NullCap capability.NullCap proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b\<rbrakk> \<Longrightarrow> cte_map slot = cte_map slot
 2. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; \<exists>t. ((), t) \<in> fst (set_cap cap.NullCap slot a) \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace s''b) \<and> cdt t = cdt a \<and> cdt_list t = cdt_list a \<and> ekheap t = ekheap a \<and> scheduler_action t = scheduler_action a \<and> ready_queues t = ready_queues a \<and> is_original_cap t = is_original_cap a \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b) \<and> (arch_state t, ksArchState s''b) \<in> arch_state_relation \<and> cur_thread t = ksCurThread s''b \<and> idle_thread t = ksIdleThread s''b \<and> machine_state t = ksMachineState s''b \<and> work_units_completed t = ksWorkUnitsCompleted s''b \<and> domain_index t = ksDomScheduleIdx s''b \<and> domain_list t = ksDomSchedule s''b \<and> cur_domain t = ksCurDomain s''b \<and> domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), s''b) \<in> fst (updateCap (cte_map slot) capability.NullCap s''a); ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState s''b) \<in> arch_state_relation; cur_thread t = ksCurThread s''b; idle_thread t = ksIdleThread s''b; machine_state t = ksMachineState s''b; work_units_completed t = ksWorkUnitsCompleted s''b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState s''b) \<in> arch_state_relation; cur_thread t = ksCurThread s''b; idle_thread t = ksIdleThread s''b; machine_state t = ksMachineState s''b; work_units_completed t = ksWorkUnitsCompleted s''b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (ctes_of s''a) (cte_map slot) (cteCap_update (K capability.NullCap)); gsUserPages s''b = gsUserPages s''a; gsCNodes s''b = gsCNodes s''a; ksMachineState s''b = ksMachineState s''a; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted s''a; ksCurThread s''b = ksCurThread s''a; ksIdleThread s''b = ksIdleThread s''a; ksReadyQueues s''b = ksReadyQueues s''a; ksSchedulerAction s''b = ksSchedulerAction s''a; ksArchState s''b = ksArchState s''a; pspace_distinct' s''a \<longrightarrow> pspace_distinct' s''b; pspace_aligned' s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; ((), ba) \<in> fst (updateMDB (cte_map slot) (const nullMDBNode) s''b); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> \<exists>x\<in>fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)). case x of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ?x346 rv rv' a b ba s'' s''a s''b t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba
 2. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> ?x346 rv rv' a b ba s'' s''a s''b t \<in> fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> ?x346 rv rv' a b ba s'' s''a s''b t \<in> fst (set_cap cap.NullCap slot (a\<lparr>cdt_list := case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := []), cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>))
 2. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ?x346 rv rv' a b ba s'' s''a s''b t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState b \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> pspace_relations (ekheap a) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> ?x346 rv rv' a b ba s'' s''a s''b t \<in> fst (set_cap cap.NullCap slot (cdt_list_update (\<lambda>_. case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) (a\<lparr>cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)))
 2. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ?x346 rv rv' a b ba s'' s''a s''b t of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState b \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> pspace_relations (ekheap a) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> ((), ?s'349 rv rv' a b ba s'' s''a s''b t) \<in> fst (set_cap cap.NullCap slot (a\<lparr>cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>))
 2. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ((), cdt_list_update (\<lambda>_. case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) (?s'349 rv rv' a b ba s'' s''a s''b t)) of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b \<and> ksCurThread ba = ksCurThread b \<and> ksIdleThread ba = ksIdleThread b \<and> ksReadyQueues ba = ksReadyQueues b \<and> ksSchedulerAction ba = ksSchedulerAction b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState b \<and> gsUserPages ba = gsUserPages b \<and> gsCNodes ba = gsCNodes b \<and> pspace_relations (ekheap a) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> ((), ?s'351 rv rv' a b ba s'' s''a s''b t) \<in> fst (set_cap cap.NullCap slot (a\<lparr>cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)\<rparr>))
 2. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ((), cdt_list_update (\<lambda>_. case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) (?s'351 rv rv' a b ba s'' s''a s''b t\<lparr>is_original_cap := (is_original_cap a)(slot := False)\<rparr>)) of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (ctes_of s''b) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) \<and> ksMachineState ba = ksMachineState s''b \<and> ksWorkUnitsCompleted ba = ksWorkUnitsCompleted s''b \<and> ksCurThread ba = ksCurThread s''b \<and> ksIdleThread ba = ksIdleThread s''b \<and> ksReadyQueues ba = ksReadyQueues s''b \<and> ksSchedulerAction ba = ksSchedulerAction s''b \<and> ksInterruptState ba = ksInterruptState s''b \<and> ksArchState ba = ksArchState s''b \<and> gsUserPages ba = gsUserPages s''b \<and> gsCNodes ba = gsCNodes s''b \<and> pspace_relations (ekheap t) (kheap t) (ksPSpace ba) \<and> pspace_aligned' ba \<and> pspace_distinct' ba \<and> no_0 (ctes_of ba) \<and> ksDomScheduleIdx ba = ksDomScheduleIdx s''b \<and> ksDomSchedule ba = ksDomSchedule s''b \<and> ksCurDomain ba = ksCurDomain s''b \<and> ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> case ((), cdt_list_update (\<lambda>_. case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) (t\<lparr>cdt := (\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None), is_original_cap := (is_original_cap a)(slot := False)\<rparr>)) of (r, t) \<Rightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap t) (ksPSpace ba) \<and> sched_act_relation (scheduler_action t) (ksSchedulerAction ba) \<and> ready_queues_relation (ready_queues t) (ksReadyQueues ba) \<and> ghost_relation (kheap t) (gsUserPages ba) (gsCNodes ba) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) (cdt t) (ctes_of ba) \<and> cdt_list_relation (cdt_list t) (cdt t) (ctes_of ba) \<and> revokable_relation (is_original_cap t) (null_filter (caps_of_state t)) (ctes_of ba) \<and> (arch_state t, ksArchState ba) \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState ba) \<and> cur_thread t = ksCurThread ba \<and> idle_thread t = ksIdleThread ba \<and> machine_state t = ksMachineState ba \<and> work_units_completed t = ksWorkUnitsCompleted ba \<and> domain_index t = ksDomScheduleIdx ba \<and> domain_list t = ksDomSchedule ba \<and> cur_domain t = ksCurDomain ba \<and> domain_time t = ksDomainTime ba proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ctes_of s'' = modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv')))); ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ctes_of s''a = modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb))); ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; ctes_of s''b = modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap)); gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ctes_of ba = modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)); ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksMachineState s'' = ksMachineState b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksMachineState s''a = ksMachineState b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksMachineState s''b = ksMachineState b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksMachineState ba = ksMachineState b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksCurThread s'' = ksCurThread b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksCurThread s''a = ksCurThread b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksCurThread s''b = ksCurThread b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksCurThread ba = ksCurThread b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksReadyQueues s'' = ksReadyQueues b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksReadyQueues s''a = ksReadyQueues b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksReadyQueues s''b = ksReadyQueues b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksReadyQueues ba = ksReadyQueues b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksSchedulerAction s'' = ksSchedulerAction b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksSchedulerAction s''a = ksSchedulerAction b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksSchedulerAction s''b = ksSchedulerAction b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksSchedulerAction ba = ksSchedulerAction b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; cte_wp_at' ((=) rv') (cte_map slot) b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t x1 x2. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE x1 x2\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot a proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot a
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_empty (ctes_of b) (cte_map slot) s_cap s_node proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_empty (ctes_of b) (cte_map slot) s_cap s_node
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of b) (cte_map slot) s_cap s_node
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> vmdb (ctes_of b)
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map slot) s_cap s_node
 3. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b)
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map slot) s_cap s_node
 3. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some rv'_; mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); pspace_relations (ekheap a_) (kheap t_) (ksPSpace s''b_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap t_) (ksPSpace ba_); pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; rv'_ = CTE s_cap_ s_node_; cte_wp_at (\<lambda>_. True) slot a_\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b_) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of b) (cte_map slot) s_cap s_node
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a\<rbrakk> \<Longrightarrow> ctes_of b (cte_map slot) = Some (CTE s_cap s_node)
 2. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ (cteCap rv'_); rv_ \<noteq> cap.NullCap; cteCap rv'_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some rv'_; mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); ghost_relation (kheap a_) (gsUserPages b_) (gsCNodes b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap a_) (ksPSpace s''_); pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); pspace_relations (ekheap a_) (kheap t_) (ksPSpace s''b_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_relations (ekheap a_) (kheap t_) (ksPSpace ba_); pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; rv'_ = CTE s_cap_ s_node_; cte_wp_at (\<lambda>_. True) slot a_\<rbrakk> \<Longrightarrow> ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_) proof (prove)
goal (1 subgoal):
 1. \<And>rv rv' a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv (cteCap rv'); rv \<noteq> cap.NullCap; cteCap rv' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some rv'; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); ghost_relation (kheap a) (gsUserPages b) (gsCNodes b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; rv' = CTE s_cap s_node; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> ghost_relation (kheap t) (gsUserPages b) (gsCNodes b) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev (cteMDBNode rv')) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext (cteMDBNode rv'))))) (mdbNext (cteMDBNode rv')) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged (cteMDBNode rv')) (mdbPrev_update (\<lambda>_. mdbPrev (cteMDBNode rv')) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relations (ekheap a) (kheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relations (ekheap a) (kheap t) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relations (ekheap a) (kheap t) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba) \<and> (\<forall>a sz. data_at sz a t = (gsUserPages b a = Some sz)) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> (\<forall>a sz. data_at sz a t = (gsUserPages b a = Some sz)) \<and> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> \<forall>a sz. data_at sz a t = (gsUserPages b a = Some sz)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) \<and> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_list_relation (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a\<rbrakk> \<Longrightarrow> no_mloop (cdt a) \<and> finite_depth (cdt a)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a\<rbrakk> \<Longrightarrow> no_mloop (cdt a) \<and> finite_depth (cdt a)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_pspace a_; valid_mdb a_\<rbrakk> \<Longrightarrow> no_mloop (cdt a_) \<and> finite_depth (cdt a_) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a); valid_mdb_ctes (ctes_of b)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a)\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a); valid_mdb_ctes (ctes_of b)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_pspace a_; valid_mdb a_; no_mloop (cdt a_) \<and> finite_depth (cdt a_)\<rbrakk> \<Longrightarrow> valid_mdb_ctes (ctes_of b_) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_pspace a; valid_mdb a; no_mloop (cdt a) \<and> finite_depth (cdt a); valid_mdb_ctes (ctes_of b)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a)\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None\<rbrakk> \<Longrightarrow> (\<forall>ab b. next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> cdt a (ab, b) \<noteq> Some slot) \<longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> (\<forall>ab b. next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> cdt a (ab, b) \<noteq> Some slot) \<longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ab\<rbrakk> \<Longrightarrow> (\<forall>ab b. next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> cdt a (ab, b) \<noteq> Some slot) \<longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ slot = None; next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = None\<rbrakk> \<Longrightarrow> (\<forall>ab b. next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some (ab, b) \<longrightarrow> cdt a_ (ab, b) \<noteq> Some slot) \<longrightarrow> (aa_, bb_) \<noteq> slot \<longrightarrow> (case next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node_ = cte_map next) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ab\<rbrakk> \<Longrightarrow> (\<forall>ab b. next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, b) \<longrightarrow> cdt a (ab, b) \<noteq> Some slot) \<longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node')\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'; \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; cte_map (aa, bb) = cte_map slot; mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_map (ab, bc) = 0
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> valid_objs (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_aligned (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_distinct (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> cte_map (ab, bc) = 0
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 10. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (13 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> valid_mdb a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> finite_depth (cdt a)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> next_slot (?p577 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap') (cdt_list a) (cdt a) = Some (?n577 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0; cte_wp_at (\<lambda>_. True) (?p577 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap') a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> valid_objs (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_aligned (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_distinct (?s570 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap')
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> cte_map (ab, bc) = 0
 10. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
A total of 13 subgoals... proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap'. \<lbrakk>mdbNext s_node = cte_map (ab, bc); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ab, bc))))) (cte_map (ab, bc)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; s_cap = cap'; mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> cte_map (ab, bc) = 0
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (CTE s_cap s_node)) \<noteq> 0
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_mdb' b
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext node'_ = cte_map (ab_, bc_); cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node_) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ slot = None; next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some (ab_, bc_); cdt a_ (ab_, bc_) \<noteq> Some slot; (aa_, bb_) \<noteq> slot; ctes_of b_ (mdbPrev s_node_) = Some (CTE cap'_ node'_); mdbPrev s_node_ \<noteq> cte_map slot; cte_map (aa_, bb_) = mdbPrev s_node_; mdbNext node_ = mdbNext s_node_\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (CTE s_cap_ s_node_)) \<noteq> 0 proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_mdb' b
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext node'_ = cte_map (ab_, bc_); cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node_) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ slot = None; next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some (ab_, bc_); cdt a_ (ab_, bc_) \<noteq> Some slot; (aa_, bb_) \<noteq> slot; ctes_of b_ (mdbPrev s_node_) = Some (CTE cap'_ node'_); mdbPrev s_node_ \<noteq> cte_map slot; cte_map (aa_, bb_) = mdbPrev s_node_; mdbNext node_ = mdbNext s_node_\<rbrakk> \<Longrightarrow> valid_mdb' b_ proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> (ab, bc) = slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (10 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_map (ab, bc) = cte_map slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, bc) (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> valid_objs (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_aligned (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_distinct (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 10. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, bc) (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> valid_objs (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_aligned (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_distinct (?s587 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; cte_map (ab, bc) = cte_map slot\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map (ab, bc); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ab, bc); cdt a (ab, bc) \<noteq> Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ab, bc)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = None; next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> valid_list_2 (?t599 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node') (cdt a)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> finite_depth (cdt a)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot\<rbrakk> \<Longrightarrow> no_mloop (cdt a)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot; next_slot (aa, bb) (?t599 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node') (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot; (aa, bb) \<noteq> slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbPrev s_node \<noteq> cte_map slot; cte_map (aa, bb) = mdbPrev s_node; mdbNext node = mdbNext s_node; (ab, bc) = slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case next_slot (aa, bb) (case cdt a slot of None \<Rightarrow> (cdt_list a)(slot := []) | Some p \<Rightarrow> (cdt_list a)(p := list_replace_list (cdt_list a p) slot (cdt_list a slot), slot := [])) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = None\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); \<forall>aa ba cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ slot = Some ab_; next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = None\<rbrakk> \<Longrightarrow> case if (aa_, bb_) = slot then None else if next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some slot then next_slot slot (cdt_list a_) (cdt a_) else next_slot (aa_, bb_) (cdt_list a_) (cdt a_) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node_ = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) ac a; valid_pspace' b; ctes_of b (cte_map ac) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap ac a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) ac a; mdb_empty (ctes_of b) (cte_map ac) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map ac) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ac) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a ac = Some ab; slot = ac; (aa, bb) \<noteq> ac; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac\<rbrakk> \<Longrightarrow> case next_slot ac (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac ad. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) ac a; valid_pspace' b; ctes_of b (cte_map ac) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap ac a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) ac a; mdb_empty (ctes_of b) (cte_map ac) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map ac) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ac) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a ac = Some ab; slot = ac; (aa, bb) \<noteq> ac; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; next_slot ac (cdt_list a) (cdt a) = Some ad\<rbrakk> \<Longrightarrow> case next_slot ac (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac ad. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) ac a; valid_pspace' b; ctes_of b (cte_map ac) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap ac a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) ac a; mdb_empty (ctes_of b) (cte_map ac) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map ac) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ac) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a ac = Some ab; slot = ac; (aa, bb) \<noteq> ac; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; next_slot ac (cdt_list a) (cdt a) = Some ad\<rbrakk> \<Longrightarrow> mdbNext node = cte_map ad
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac ad. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) ac a; valid_pspace' b; ctes_of b (cte_map ac) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap ac a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) ac a; mdb_empty (ctes_of b) (cte_map ac) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map ac) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map ac) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a ac = Some ab; slot = ac; (aa, bb) \<noteq> ac; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; next_slot ac (cdt_list a) (cdt a) = Some ad; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map ac then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node')\<rbrakk> \<Longrightarrow> mdbNext node = cte_map ad
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); mdbNext node \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map (ac, bd) then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); mdbNext node \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map (ac, bd) then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'; \<forall>x ba cap node. ctes_of b (cte_map (x, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (x, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); mdbNext node \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map (ac, bd) then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'; \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); \<forall>cap node. ctes_of b (cte_map (ac, bd)) = Some (CTE cap node) \<longrightarrow> (case next_slot (ac, bd) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_node aa bb cap node ab bc ac bd ad be cap'. \<lbrakk>mdbNext s_node = cte_map (ad, be); cte_map (ac, bd) = cte_map (ad, be); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ad, be)) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ad, be)) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ad, be)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ad, be)) (cteMDBNode_update (const nullMDBNode)) (cte_map (ad, be)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ad, be) \<noteq> 0; cte_map (aa, bb) = cte_map (ad, be); mdbNext node = 0\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_node aa bb cap node ab bc ac bd ad be cap'. \<lbrakk>mdbNext s_node = cte_map (ad, be); cte_map (ac, bd) = cte_map (ad, be); cap_relation info info'; cap_relation rv cap'; rv \<noteq> cap.NullCap; cap' \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ad, be)) = Some (CTE cap' s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ad, be)) cap' s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ad, be)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ad, be)) (cteMDBNode_update (const nullMDBNode)) (cte_map (ad, be)) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ad, be) \<noteq> 0; cte_map (aa, bb) = cte_map (ad, be); mdbNext node = 0; mdbNext (cteMDBNode (CTE cap' s_node)) \<noteq> cte_map (ad, be)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE cap' node')) \<noteq> 0
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> valid_mdb' b
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd); \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE cap' node'))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map (aa, bb)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> valid_mdb' b
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd); \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE cap' node'))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map (aa, bb)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdbNext node'_ = cte_map (ac_, bd_); mdbNext s_node_ = cte_map (ad_, be_); cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) (ac_, bd_) a_; valid_pspace' b_; ctes_of b_ (cte_map (ac_, bd_)) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap (ac_, bd_) a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) (ac_, bd_) a_; mdb_empty (ctes_of b_) (cte_map (ac_, bd_)) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad_, be_))))) (cte_map (ad_, be_)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map (ac_, bd_)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac_, bd_)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ (ac_, bd_) = Some (ab_, bc_); slot = (ac_, bd_); next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some (ac_, bd_); next_slot (ac_, bd_) (cdt_list a_) (cdt a_) = Some (ad_, be_); cte_map (ac_, bd_) \<noteq> cte_map (ad_, be_); cte_map (aa_, bb_) \<noteq> cte_map (ac_, bd_); cte_map (aa_, bb_) \<noteq> mdbPrev s_node_; mdbNext node_ = cte_map (ac_, bd_)\<rbrakk> \<Longrightarrow> valid_mdb' b_ proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd ad be cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); mdbNext s_node = cte_map (ad, be); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (ac, bd) a; valid_pspace' b; ctes_of b (cte_map (ac, bd)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (ac, bd) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (ac, bd) a; mdb_empty (ctes_of b) (cte_map (ac, bd)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (ad, be))))) (cte_map (ad, be)) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (ac, bd)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (ac, bd)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a (ac, bd) = Some (ab, bc); slot = (ac, bd); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); next_slot (ac, bd) (cdt_list a) (cdt a) = Some (ad, be); cte_map (ac, bd) \<noteq> cte_map (ad, be); cte_map (aa, bb) \<noteq> cte_map (ac, bd); cte_map (aa, bb) \<noteq> mdbPrev s_node; mdbNext node = cte_map (ac, bd); \<exists>c. ctes_of b (mdbNext (cteMDBNode (CTE cap' node'))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map (aa, bb)\<rbrakk> \<Longrightarrow> aa = ac \<and> bb = bd
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; next_slot (aa, bb) (cdt_list a) (cdt a) \<noteq> Some slot\<rbrakk> \<Longrightarrow> case if (aa, bb) = slot then None else if next_slot (aa, bb) (cdt_list a) (cdt a) = Some slot then next_slot slot (cdt_list a) (cdt a) else next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; ac \<noteq> slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map ac
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); \<forall>aa ba cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, ba) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; ac \<noteq> slot; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node')\<rbrakk> \<Longrightarrow> mdbNext node = cte_map ac
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab ac. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some ab; next_slot (aa, bb) (cdt_list a) (cdt a) = Some ac; (aa, bb) \<noteq> slot; ac \<noteq> slot; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then mdbNext node = 0 else if cte_map (aa, bb) = mdbPrev s_node then mdbNext node = mdbNext s_node else mdbNext node = mdbNext node'); \<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list a) (cdt a) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map ac
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (mdbPrev s_node) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; mdbPrev s_node = cte_map slot \<or> ctes_of b (mdbPrev s_node) = Some (CTE cap' node') \<and> mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (mdbPrev s_node) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; mdbPrev s_node = cte_map slot \<or> ctes_of b (mdbPrev s_node) = Some (CTE cap' node') \<and> mdbNext node = mdbNext s_node; mdbPrev (cteMDBNode (CTE s_cap s_node)) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> mdbPrev (cteMDBNode (CTE s_cap s_node)) \<noteq> 0
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_mdb' b
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ac, bd)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_mdb' b
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; \<exists>c. ctes_of b (mdbPrev (cteMDBNode (CTE s_cap s_node))) = Some c \<and> mdbNext (cteMDBNode c) = cte_map slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; cte_map (ac, bd) = cte_map slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ac, bd) (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_objs (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> pspace_aligned (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> pspace_distinct (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; (ac, bd) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; cte_wp_at (\<lambda>_. True) (ac, bd) a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ac, bd) (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> valid_objs (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> pspace_aligned (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node\<rbrakk> \<Longrightarrow> pspace_distinct (?s706 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; (ac, bd) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>mdbNext node' = cte_map slot; cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (mdbPrev s_node) = Some (CTE cap node); valid_mdb a; valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) = mdbPrev s_node; mdbPrev s_node \<noteq> cte_map slot; ctes_of b (mdbPrev s_node) = Some (CTE cap' node'); mdbNext node = mdbNext s_node; (ac, bd) = slot\<rbrakk> \<Longrightarrow> mdbNext s_node = cte_map slot
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot \<or> ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_map (aa, bb) = cte_map slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> valid_objs (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_aligned (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_distinct (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (9 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) slot (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> valid_objs (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_aligned (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0\<rbrakk> \<Longrightarrow> pspace_distinct (?s721 rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node')
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 9. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; (aa, bb) = slot\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb cap node ab bc ac bd cap' node'. \<lbrakk>\<forall>cap node. ctes_of b (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac, bd); cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); valid_mdb a; valid_mdb_ctes (ctes_of b); valid_objs a; no_mloop (cdt a); finite_depth (cdt a); pspace_aligned a; pspace_distinct a; if_live_then_nonz_cap a; zombies_final a; sym_refs (state_refs_of a); sym_refs (state_hyp_refs_of a); cdt a slot = Some (ab, bc); next_slot (aa, bb) (cdt_list a) (cdt a) = Some (ac, bd); (aa, bb) \<noteq> slot; (ac, bd) \<noteq> slot; cte_map (aa, bb) \<noteq> mdbPrev s_node; cte_map (aa, bb) = cte_map slot \<longrightarrow> s_cap = cap' \<and> s_node = node' \<and> mdbNext node = 0; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> mdbNext node = cte_map (ac, bd)\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ac, bd)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>cap node. ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap node) \<longrightarrow> mdbNext node = cte_map (ac_, bd_); cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); valid_mdb a_; valid_mdb_ctes (ctes_of b_); valid_objs a_; no_mloop (cdt a_); finite_depth (cdt a_); pspace_aligned a_; pspace_distinct a_; if_live_then_nonz_cap a_; zombies_final a_; sym_refs (state_refs_of a_); sym_refs (state_hyp_refs_of a_); cdt a_ slot = Some (ab_, bc_); next_slot (aa_, bb_) (cdt_list a_) (cdt a_) = Some (ac_, bd_); (aa_, bb_) \<noteq> slot; (ac_, bd_) \<noteq> slot; cte_map (aa_, bb_) \<noteq> mdbPrev s_node_; cte_map (aa_, bb_) = cte_map slot \<longrightarrow> s_cap_ = cap'_ \<and> s_node_ = node'_ \<and> mdbNext node_ = 0; ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap'_ node'_) \<and> mdbNext node_ = cte_map (ac_, bd_)\<rbrakk> \<Longrightarrow> mdbNext node_ = cte_map (ac_, bd_) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap a)(slot := False)) (null_filter (caps_of_state t)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> \<forall>aa ba. ((aa, ba) = slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) slot = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node) \<longrightarrow> \<not> mdbRevocable node)) \<and> ((aa, ba) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> ((aa, bb) = slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) slot = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node) \<longrightarrow> \<not> mdbRevocable node)) \<and> ((aa, bb) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, bb) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node))
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (aa, bb) = slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) slot = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map slot) = Some (CTE cap node) \<longrightarrow> \<not> mdbRevocable node)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, bb) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (aa, bb) a; valid_pspace' b; ctes_of b (cte_map (aa, bb)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (aa, bb) a; mdb_empty (ctes_of b) (cte_map (aa, bb)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); slot = (aa, bb); null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (aa, bb)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (aa, bb)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); mdbRevocable node\<rbrakk> \<Longrightarrow> False
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, bb) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) (aa, bb) a; valid_pspace' b; ctes_of b (cte_map (aa, bb)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap (aa, bb) a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) (aa, bb) a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); slot = (aa, bb); null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map (aa, bb)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (aa, bb)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); mdbRevocable node; \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map (aa, bb) then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node')\<rbrakk> \<Longrightarrow> False
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, bb) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) (aa_, bb_) a_; valid_pspace' b_; ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap (aa_, bb_) a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); slot = (aa_, bb_); null_filter (caps_of_state t_) (aa_, bb_) = Some y_; modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map (aa_, bb_)) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map (aa_, bb_)) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); mdbRevocable node_; \<exists>cap' node'. ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap' node') \<and> (if cte_map (aa_, bb_) = cte_map (aa_, bb_) then \<not> mdbRevocable node_ else mdbRevocable node_ = mdbRevocable node')\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba)\<rbrakk> \<Longrightarrow> (aa, bb) \<noteq> slot \<longrightarrow> (\<exists>y. null_filter (caps_of_state t) (aa, bb) = Some y) \<longrightarrow> (\<forall>cap node. modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node)\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node')\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node')\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node')\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'); caps_of_state t = (caps_of_state a)(slot \<mapsto> cap.NullCap)\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a) (aa, bb) \<noteq> None
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); (aa_, bb_) \<noteq> slot; null_filter (caps_of_state t_) (aa_, bb_) = Some y_; modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); \<exists>cap' node'. ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap' node') \<and> (if cte_map (aa_, bb_) = cte_map slot then \<not> mdbRevocable node_ else mdbRevocable node_ = mdbRevocable node'); caps_of_state t_ = (caps_of_state a_)(slot \<mapsto> cap.NullCap)\<rbrakk> \<Longrightarrow> null_filter (caps_of_state a_) (aa_, bb_) \<noteq> None proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); \<exists>cap' node'. ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node') \<and> (if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'); null_filter (caps_of_state a) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap a (aa, bb) = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); (aa, bb) \<noteq> slot; null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'; cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb y cap node cap' ya node'. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a (aa, ba) = mdbRevocable node); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); null_filter (caps_of_state t) (aa, bb) = Some y; modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa, bb)) = Some (CTE cap node); null_filter (caps_of_state a) (aa, bb) = Some ya; ctes_of b (cte_map (aa, bb)) = Some (CTE cap' node'); if cte_map (aa, bb) = cte_map slot then \<not> mdbRevocable node else mdbRevocable node = mdbRevocable node'; cte_wp_at (\<lambda>_. True) (aa, bb) a; cte_map (aa, bb) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> mdbRevocable node' = mdbRevocable node
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a_) (cdt a_) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); \<forall>aa ba. (\<exists>y. null_filter (caps_of_state a_) (aa, ba) = Some y) \<longrightarrow> (\<forall>cap node. ctes_of b_ (cte_map (aa, ba)) = Some (CTE cap node) \<longrightarrow> is_original_cap a_ (aa, ba) = mdbRevocable node); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); null_filter (caps_of_state t_) (aa_, bb_) = Some y_; modify_map (modify_map (modify_map (modify_map (ctes_of b_) (mdbPrev s_node_) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node_)))) (mdbNext s_node_) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node_) (mdbPrev_update (\<lambda>_. mdbPrev s_node_) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode)) (cte_map (aa_, bb_)) = Some (CTE cap_ node_); null_filter (caps_of_state a_) (aa_, bb_) = Some ya_; ctes_of b_ (cte_map (aa_, bb_)) = Some (CTE cap'_ node'_); if cte_map (aa_, bb_) = cte_map slot then \<not> mdbRevocable node_ else mdbRevocable node_ = mdbRevocable node'_; cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; cte_map (aa_, bb_) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> mdbRevocable node'_ = mdbRevocable node_ proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) a) (cdt a) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_relation (kheap a) (ksPSpace s'') \<and> ekheap_relation (ekheap a) (ksPSpace s''); pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); pspace_relation (kheap t) (ksPSpace s''b) \<and> ekheap_relation (ekheap a) (ksPSpace s''b); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_relation (kheap t) (ksPSpace ba) \<and> ekheap_relation (ekheap a) (ksPSpace ba); pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n)\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) t) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((\<lambda>p. if cdt a p = Some slot then cdt a slot else cdt a p)(slot := None)) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = slot then {} else descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (modify_map (modify_map (ctes_of b) (mdbPrev s_node) (cteMDBNode_update (mdbNext_update (\<lambda>_. mdbNext s_node)))) (mdbNext s_node) (cteMDBNode_update (\<lambda>mdb. mdbFirstBadged_update (\<lambda>_. mdbFirstBadged mdb \<or> mdbFirstBadged s_node) (mdbPrev_update (\<lambda>_. mdbPrev s_node) mdb)))) (cte_map slot) (cteCap_update (\<lambda>y. capability.NullCap))) (cte_map slot) (cteMDBNode_update (const nullMDBNode))) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> cte_map ` (if (aa, bb) = slot then {} else descendants_of (aa, bb) (cdt a) - {slot}) = (if cte_map (aa, bb) = cte_map slot then {} else descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; (aa, bb) \<noteq> slot\<rbrakk> \<Longrightarrow> (cte_map (aa, bb) = cte_map slot \<longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> {slot}) \<and> (cte_map (aa, bb) \<noteq> cte_map slot \<longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) t; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t = cte_wp_at (\<lambda>_. True) (aa, bb) a\<rbrakk> \<Longrightarrow> (cte_map (aa, bb) = cte_map slot \<longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> {slot}) \<and> (cte_map (aa, bb) \<noteq> cte_map slot \<longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t\<rbrakk> \<Longrightarrow> (cte_map (aa, bb) = cte_map slot \<longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> {slot}) \<and> (cte_map (aa, bb) \<noteq> cte_map slot \<longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> (cte_map (aa, bb) = cte_map slot \<longrightarrow> descendants_of (aa, bb) (cdt a) \<subseteq> {slot}) \<and> (cte_map (aa, bb) \<noteq> cte_map slot \<longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> inj_on cte_map (?C829 rv a b ba s'' s''a s''b t s_cap s_node aa bb)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> ?C829 rv a b ba s'' s''a s''b t s_cap s_node aa bb
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> ?C829 rv a b ba s'' s''a s''b t s_cap s_node aa bb
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (8 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_mdb (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb)
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb))
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt (?s831 rv a b ba s'' s''a s''b t s_cap s_node aa bb))
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 8. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (7 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 7. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (6 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 6. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of (aa, bb) (cdt a) - {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (?p831 rv a b ba s'' s''a s''b t s_cap s_node aa bb) (cdt a)
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (aa, bb) (cdt a)
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a_ \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a_) = descendants_of' (cte_map (aa, ba)) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa_, bb_) t_; cte_map (aa_, bb_) \<noteq> cte_map slot; slot \<in> descendants_of (aa_, bb_) (cdt a_)\<rbrakk> \<Longrightarrow> {slot} \<subseteq> descendants_of (aa_, bb_) (cdt a_) proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (cdt a) - cte_map ` {slot} = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a_ \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a_) = descendants_of' (cte_map (aa, ba)) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa_, bb_) t_; cte_map (aa_, bb_) \<noteq> cte_map slot; slot \<in> descendants_of (aa_, bb_) (cdt a_)\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa_, bb_) (cdt a_) - cte_map ` {slot} = descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) - {cte_map slot} proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map ` (descendants_of (aa, bb) (cdt a) - {slot}) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa, bb)) (ctes_of b) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot} proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a); cte_map slot \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa, bb)) (ctes_of b) = descendants_of' (cte_map (aa, bb)) (ctes_of b) - {cte_map slot}
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map slot \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_relation info info'; cap_relation rv_ s_cap_; rv_ \<noteq> cap.NullCap; s_cap_ \<noteq> capability.NullCap; invs a_; valid_list a_; valid_sched_2 (ready_queues a_) (ekheap a_) (scheduler_action a_) (ksCurDomain b_) (kheap a_) (ksCurThread b_) (ksIdleThread b_); cte_wp_at ((=) rv_) slot a_; valid_pspace' b_; ctes_of b_ (cte_map slot) = Some (CTE s_cap_ s_node_); mdb_empty_abs a_; mdb_empty_abs' a_; pspace_relation (kheap a_) (ksPSpace b_); ekheap_relation (ekheap a_) (ksPSpace b_); sched_act_relation (scheduler_action a_) (ksSchedulerAction b_); ready_queues_relation (ready_queues a_) (ksReadyQueues b_); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a_ \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a_) = descendants_of' (cte_map (aa, ba)) (ctes_of b_); cdt_list_relation (cdt_list a_) (cdt a_) (ctes_of b_); revokable_relation (is_original_cap a_) (null_filter (caps_of_state a_)) (ctes_of b_); (arch_state a_, ksArchState b_) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a_) (interrupt_states a_) (ksInterruptState b_); cur_thread a_ = ksCurThread b_; idle_thread a_ = ksIdleThread b_; machine_state a_ = ksMachineState b_; work_units_completed a_ = ksWorkUnitsCompleted b_; domain_index a_ = ksDomScheduleIdx b_; domain_list a_ = ksDomSchedule b_; cur_domain a_ = ksCurDomain b_; domain_time a_ = ksDomainTime b_; ksWorkUnitsCompleted s''_ = ksWorkUnitsCompleted b_; ksIdleThread s''_ = ksIdleThread b_; ksInterruptState s''_ = ksInterruptState b_; ksArchState s''_ = ksArchState b_; gsUserPages s''_ = gsUserPages b_; gsCNodes s''_ = gsCNodes b_; pspace_aligned' s''_; pspace_distinct' s''_; no_0 (ctes_of b_); ksDomScheduleIdx s''_ = ksDomScheduleIdx b_; ksDomSchedule s''_ = ksDomSchedule b_; ksCurDomain s''_ = ksCurDomain b_; ksDomainTime s''_ = ksDomainTime b_; ksWorkUnitsCompleted s''a_ = ksWorkUnitsCompleted b_; ksIdleThread s''a_ = ksIdleThread b_; ksInterruptState s''a_ = ksInterruptState b_; ksArchState s''a_ = ksArchState b_; gsUserPages s''a_ = gsUserPages b_; gsCNodes s''a_ = gsCNodes b_; pspace_aligned' s''a_; pspace_distinct' s''a_; ksDomScheduleIdx s''a_ = ksDomScheduleIdx b_; ksDomSchedule s''a_ = ksDomSchedule b_; ksCurDomain s''a_ = ksCurDomain b_; ksDomainTime s''a_ = ksDomainTime b_; ((), t_) \<in> fst (set_cap cap.NullCap slot a_); cdt t_ = cdt a_; cdt_list t_ = cdt_list a_; ekheap t_ = ekheap a_; scheduler_action t_ = scheduler_action a_; ready_queues t_ = ready_queues a_; is_original_cap t_ = is_original_cap a_; interrupt_state_relation (interrupt_irq_node t_) (interrupt_states t_) (ksInterruptState s''b_); (arch_state t_, ksArchState b_) \<in> arch_state_relation; cur_thread t_ = ksCurThread b_; idle_thread t_ = ksIdleThread b_; machine_state t_ = ksMachineState b_; work_units_completed t_ = ksWorkUnitsCompleted b_; domain_index t_ = ksDomScheduleIdx s''b_; domain_list t_ = ksDomSchedule s''b_; cur_domain t_ = ksCurDomain s''b_; domain_time t_ = ksDomainTime s''b_; gsUserPages s''b_ = gsUserPages b_; gsCNodes s''b_ = gsCNodes b_; ksWorkUnitsCompleted s''b_ = ksWorkUnitsCompleted b_; ksIdleThread s''b_ = ksIdleThread b_; ksArchState s''b_ = ksArchState b_; pspace_distinct' s''b_; pspace_aligned' s''b_; ksWorkUnitsCompleted ba_ = ksWorkUnitsCompleted b_; ksIdleThread ba_ = ksIdleThread b_; ksInterruptState ba_ = ksInterruptState s''b_; ksArchState ba_ = ksArchState b_; gsUserPages ba_ = gsUserPages b_; gsCNodes ba_ = gsCNodes b_; pspace_aligned' ba_; pspace_distinct' ba_; ksDomScheduleIdx ba_ = ksDomScheduleIdx s''b_; ksDomSchedule ba_ = ksDomSchedule s''b_; ksCurDomain ba_ = ksCurDomain s''b_; ksDomainTime ba_ = ksDomainTime s''b_; cte_wp_at (\<lambda>_. True) slot a_; mdb_empty (ctes_of b_) (cte_map slot) s_cap_ s_node_; \<forall>aa sz. data_at sz aa a_ = (gsUserPages b_ aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a_ = (gsCNodes b_ aa = Some n); pspace_relation (kheap a_) (ksPSpace s''_); ekheap_relation (ekheap a_) (ksPSpace s''_); pspace_relation (kheap t_) (ksPSpace s''b_); ekheap_relation (ekheap a_) (ksPSpace s''b_); pspace_relation (kheap t_) (ksPSpace ba_); ekheap_relation (ekheap a_) (ksPSpace ba_); cte_wp_at (\<lambda>_. True) (aa_, bb_) a_; (aa_, bb_) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa_, bb_) t_; cte_map (aa_, bb_) \<noteq> cte_map slot; slot \<notin> descendants_of (aa_, bb_) (cdt a_); cte_map slot \<notin> descendants_of' (cte_map (aa_, bb_)) (ctes_of b_)\<rbrakk> \<Longrightarrow> descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) = descendants_of' (cte_map (aa_, bb_)) (ctes_of b_) - {cte_map slot} proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); \<forall>aa ba. cte_wp_at (\<lambda>_. True) (aa, ba) a \<longrightarrow> cte_map ` descendants_of (aa, ba) (cdt a) = descendants_of' (cte_map (aa, ba)) (ctes_of b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map slot \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a); cte_map ` descendants_of (aa, bb) (cdt a) = descendants_of' (cte_map (aa, bb)) (ctes_of b)\<rbrakk> \<Longrightarrow> cte_map slot \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map slot) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map slot) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map slot; slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_map slot \<notin> descendants_of' (cte_map (aa, bb)) (ctes_of b) proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); cte_map slot = cte_map (ab, bc); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (5 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (ab, bc) a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 5. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); slot = (ab, bc)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (4 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> valid_objs a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 4. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); slot = (ab, bc)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (3 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_aligned a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 3. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); slot = (ab, bc)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a)\<rbrakk> \<Longrightarrow> pspace_distinct a
 2. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); slot = (ab, bc)\<rbrakk> \<Longrightarrow> False proof (prove)
goal (1 subgoal):
 1. \<And>rv a b ba s'' s''a s''b t s_cap s_node aa bb ab bc. \<lbrakk>cap_relation info info'; cap_relation rv s_cap; rv \<noteq> cap.NullCap; s_cap \<noteq> capability.NullCap; invs a; valid_list a; valid_sched_2 (ready_queues a) (ekheap a) (scheduler_action a) (ksCurDomain b) (kheap a) (ksCurThread b) (ksIdleThread b); cte_wp_at ((=) rv) slot a; valid_pspace' b; ctes_of b (cte_map (ab, bc)) = Some (CTE s_cap s_node); mdb_empty_abs a; mdb_empty_abs' a; pspace_relation (kheap a) (ksPSpace b); ekheap_relation (ekheap a) (ksPSpace b); sched_act_relation (scheduler_action a) (ksSchedulerAction b); ready_queues_relation (ready_queues a) (ksReadyQueues b); cdt_list_relation (cdt_list a) (cdt a) (ctes_of b); revokable_relation (is_original_cap a) (null_filter (caps_of_state a)) (ctes_of b); (arch_state a, ksArchState b) \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node a) (interrupt_states a) (ksInterruptState b); cur_thread a = ksCurThread b; idle_thread a = ksIdleThread b; machine_state a = ksMachineState b; work_units_completed a = ksWorkUnitsCompleted b; domain_index a = ksDomScheduleIdx b; domain_list a = ksDomSchedule b; cur_domain a = ksCurDomain b; domain_time a = ksDomainTime b; ksWorkUnitsCompleted s'' = ksWorkUnitsCompleted b; ksIdleThread s'' = ksIdleThread b; ksInterruptState s'' = ksInterruptState b; ksArchState s'' = ksArchState b; gsUserPages s'' = gsUserPages b; gsCNodes s'' = gsCNodes b; pspace_aligned' s''; pspace_distinct' s''; no_0 (ctes_of b); ksDomScheduleIdx s'' = ksDomScheduleIdx b; ksDomSchedule s'' = ksDomSchedule b; ksCurDomain s'' = ksCurDomain b; ksDomainTime s'' = ksDomainTime b; ksWorkUnitsCompleted s''a = ksWorkUnitsCompleted b; ksIdleThread s''a = ksIdleThread b; ksInterruptState s''a = ksInterruptState b; ksArchState s''a = ksArchState b; gsUserPages s''a = gsUserPages b; gsCNodes s''a = gsCNodes b; pspace_aligned' s''a; pspace_distinct' s''a; ksDomScheduleIdx s''a = ksDomScheduleIdx b; ksDomSchedule s''a = ksDomSchedule b; ksCurDomain s''a = ksCurDomain b; ksDomainTime s''a = ksDomainTime b; ((), t) \<in> fst (set_cap cap.NullCap slot a); cdt t = cdt a; cdt_list t = cdt_list a; ekheap t = ekheap a; scheduler_action t = scheduler_action a; ready_queues t = ready_queues a; is_original_cap t = is_original_cap a; interrupt_state_relation (interrupt_irq_node t) (interrupt_states t) (ksInterruptState s''b); (arch_state t, ksArchState b) \<in> arch_state_relation; cur_thread t = ksCurThread b; idle_thread t = ksIdleThread b; machine_state t = ksMachineState b; work_units_completed t = ksWorkUnitsCompleted b; domain_index t = ksDomScheduleIdx s''b; domain_list t = ksDomSchedule s''b; cur_domain t = ksCurDomain s''b; domain_time t = ksDomainTime s''b; gsUserPages s''b = gsUserPages b; gsCNodes s''b = gsCNodes b; ksWorkUnitsCompleted s''b = ksWorkUnitsCompleted b; ksIdleThread s''b = ksIdleThread b; ksArchState s''b = ksArchState b; pspace_distinct' s''b; pspace_aligned' s''b; ksWorkUnitsCompleted ba = ksWorkUnitsCompleted b; ksIdleThread ba = ksIdleThread b; ksInterruptState ba = ksInterruptState s''b; ksArchState ba = ksArchState b; gsUserPages ba = gsUserPages b; gsCNodes ba = gsCNodes b; pspace_aligned' ba; pspace_distinct' ba; ksDomScheduleIdx ba = ksDomScheduleIdx s''b; ksDomSchedule ba = ksDomSchedule s''b; ksCurDomain ba = ksCurDomain s''b; ksDomainTime ba = ksDomainTime s''b; cte_wp_at (\<lambda>_. True) slot a; mdb_empty (ctes_of b) (cte_map (ab, bc)) s_cap s_node; \<forall>aa sz. data_at sz aa a = (gsUserPages b aa = Some sz); \<forall>aa n. typ_at (ACapTable n) aa a = (gsCNodes b aa = Some n); pspace_relation (kheap a) (ksPSpace s''); ekheap_relation (ekheap a) (ksPSpace s''); pspace_relation (kheap t) (ksPSpace s''b); ekheap_relation (ekheap a) (ksPSpace s''b); pspace_relation (kheap t) (ksPSpace ba); ekheap_relation (ekheap a) (ksPSpace ba); cte_wp_at (\<lambda>_. True) (aa, bb) a; (aa, bb) \<noteq> slot; cte_wp_at (\<lambda>_. True) (aa, bb) t; cte_map (aa, bb) \<noteq> cte_map (ab, bc); slot \<notin> descendants_of (aa, bb) (cdt a); descendants_of' (cte_map (aa, bb)) (ctes_of b) = cte_map ` descendants_of (aa, bb) (cdt a); (ab, bc) \<in> descendants_of (aa, bb) (cdt a); slot = (ab, bc)\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!