theory CNode_DR

lemma insert_cap_sibling_corres:
  "dcorres dc \<top>
        (\<lambda>s. cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s src)
                 cap (cap_insert_dest_original cap cap')) src s
              \<and> cte_wp_at ((=) cap.NullCap) sibling s
              \<and> cte_at src s
              \<and> not_idle_thread (fst sibling) s
              \<and> not_idle_thread (fst src) s \<and> valid_etcbs s
              \<and> valid_mdb s \<and> valid_idle s \<and> valid_objs s \<and> cap_aligned cap)
        (insert_cap_sibling (transform_cap cap) (transform_cslot_ptr src) (transform_cslot_ptr sibling))
        (cap_insert cap src sibling)" supply if_cong[cong] apply (simp add: cap_insert_def[folded cap_insert_dest_original_def]) apply (simp add: insert_cap_sibling_def insert_cap_orphan_def bind_assoc
                   option_return_modify_modify
                   gets_fold_into_modify update_cdt_modify
                   set_original_def modify_modify
                   cap_insert_ext_def update_cdt_list_def set_cdt_list_modify
             cong: option.case_cong) apply (rule stronger_corres_guard_imp) apply (rule corres_split[OF get_cap_corres], simp)+ apply (rule corres_assert_lhs corres_assert_rhs)+ apply (rule_tac F = "src_cap = transform_cap src_capa" in corres_gen_asm) apply simp apply (rule corres_split[OF dcorres_set_untyped_cap_as_full]) apply (rule corres_split[OF set_cap_corres[OF refl refl]]) apply (rule dcorres_opt_parent_set_parent_helper) apply (clarsimp simp:gets_fold_into_modify dc_def[symmetric]
              option_return_modify_modify modify_modify bind_assoc
              cong:option.case_cong) apply (rule_tac P=\<top> and P'="(\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap orig')
              and cte_at src and cte_at sibling
              and (\<lambda>s. mdb_cte_at (swp cte_at s) (cdt s))
              and (\<lambda>s. cdt s sibling = None)" for orig'
              in corres_modify) apply (clarsimp split del: if_split) apply (subst if_not_P, assumption)+ apply (clarsimp simp: opt_parent_def transform_def
              transform_objects_def transform_cdt_def
              transform_current_thread_def
              transform_asid_table_def
              split: option.split) apply (clarsimp simp: fun_upd_def[symmetric] cong:if_cong) apply (subgoal_tac "inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))") apply (subst map_lift_over_f_eq map_lift_over_upd,
               erule subset_inj_on, fastforce)+ apply (simp add: map_option_is_None[THEN trans [OF eq_commute]]
               fun_eq_iff del: inj_on_insert) apply (subst eq_commute [where a=None]) apply (subst map_lift_over_f_eq map_lift_over_upd,
               erule subset_inj_on, fastforce)+ apply clarsimp apply (rule_tac s=s' in transform_cdt_slot_inj_on_cte_at[where P=\<top>]) apply (auto simp: swp_def dest: mdb_cte_atD
              elim!: ranE)[1] apply ((wp set_cap_caps_of_state2 get_cap_wp hoare_weak_lift_imp
             | simp add: swp_def cte_wp_at_caps_of_state)+) apply (wp set_cap_idle |
            simp add:set_untyped_cap_as_full_def split del: if_split)+ apply (rule_tac Q = "\<lambda>r s. cdt s sibling = None
           \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (cap_insert_dest_original cap src_capa)
           \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)"
           in hoare_strengthen_post) apply (wp set_cap_mdb_cte_at arch_update_cap_valid_mdb) apply (clarsimp simp:mdb_cte_at_def should_be_parent_of_def
           cte_wp_at_caps_of_state has_parent_cte_at is_physical_def
           dest!:is_untyped_cap_eqD) apply fastforce apply (wp get_cap_wp set_cap_idle hoare_weak_lift_imp
           | simp add:set_untyped_cap_as_full_def
           split del: if_split)+ apply (rule_tac Q = "\<lambda>r s. cdt s sibling = None
           \<and> (\<exists>cap. caps_of_state s src = Some cap)
           \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (cap_insert_dest_original cap src_capa)
           \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)"
           in hoare_strengthen_post) apply (wp set_cap_mdb_cte_at arch_update_cap_valid_mdb) apply (clarsimp simp:mdb_cte_at_def should_be_parent_of_def
           cte_wp_at_caps_of_state has_parent_cte_at is_physical_def
           dest!:is_untyped_cap_eqD) apply fastforce apply (wp get_cap_wp set_cap_idle | simp)+ apply clarsimp apply (clarsimp simp: not_idle_thread_def) apply (clarsimp simp: caps_of_state_transform_opt_cap cte_wp_at_caps_of_state
     transform_cap_def) apply (clarsimp simp: not_idle_thread_def cte_wp_at_caps_of_state) apply (clarsimp simp: valid_mdb_def cte_wp_at_cases dest!:invs_mdb) apply (case_tac "cdt s' sibling", safe intro!: mdb_cte_atI) 
  (* 145 subgoals *)
   by (auto dest: mdb_cte_atD is_untyped_cap_eqD
           simp: revokable_cap_insert_dest_original valid_mdb_def
                 swp_def cte_wp_at_caps_of_state not_idle_thread_def)

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s src) cap (cap_insert_dest_original cap cap')) src s \<and> cte_wp_at ((=) cap.NullCap) sibling s \<and> cte_wp_at (\<lambda>_. True) src s \<and> not_idle_thread (fst sibling) s \<and> not_idle_thread (fst src) s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_idle s \<and> valid_objs s \<and> cap_aligned cap) (insert_cap_sibling (transform_cap cap) (transform_cslot_ptr src) (transform_cslot_ptr sibling)) (cap_insert cap src sibling) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s src) cap (cap_insert_dest_original cap cap')) src s \<and> cte_wp_at ((=) cap.NullCap) sibling s \<and> cte_wp_at (\<lambda>_. True) src s \<and> not_idle_thread (fst sibling) s \<and> not_idle_thread (fst src) s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_idle s \<and> valid_objs s \<and> cap_aligned cap) (insert_cap_sibling (transform_cap cap) (transform_cslot_ptr src) (transform_cslot_ptr sibling)) (cap_insert cap src sibling) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s src) cap (cap_insert_dest_original cap cap')) src s \<and> cte_wp_at ((=) cap.NullCap) sibling s \<and> cte_wp_at (\<lambda>_. True) src s \<and> not_idle_thread (fst sibling) s \<and> not_idle_thread (fst src) s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_idle s \<and> valid_objs s \<and> cap_aligned cap) (insert_cap_sibling (transform_cap cap) (transform_cslot_ptr src) (transform_cslot_ptr sibling)) (do src_cap <- CSpaceAcc_A.get_cap src;
old_cap <- CSpaceAcc_A.get_cap sibling;
y <- assert (old_cap = cap.NullCap);
y <- CSpace_A.set_untyped_cap_as_full src_cap cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s sibling);
y <- update_cdt (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else cdt src));
y <- cap_insert_ext (should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap)) src sibling src_p dest_p;
set_original sibling (is_cap_revocable cap src_cap)
od) proof (prove)
goal (1 subgoal):
 1. dcorres dc (\<lambda>_. True) (\<lambda>s. cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s src) cap (cap_insert_dest_original cap cap')) src s \<and> cte_wp_at ((=) cap.NullCap) sibling s \<and> cte_wp_at (\<lambda>_. True) src s \<and> not_idle_thread (fst sibling) s \<and> not_idle_thread (fst src) s \<and> valid_etcbs s \<and> valid_mdb s \<and> valid_idle s \<and> valid_objs s \<and> cap_aligned cap) (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr src);
old_cap <- KHeap_D.get_cap (transform_cslot_ptr sibling);
y <- assert (old_cap = cdl_cap.NullCap);
y <- CSpace_D.set_untyped_cap_as_full src_cap (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do src_cap <- CSpaceAcc_A.get_cap src;
old_cap <- CSpaceAcc_A.get_cap sibling;
y <- assert (old_cap = cap.NullCap);
y <- CSpace_A.set_untyped_cap_as_full src_cap cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_cap)\<rparr>)
od) proof (prove)
goal (3 subgoals):
 1. dcorres dc ?Q19 ?Q'19 (do src_cap <- KHeap_D.get_cap (transform_cslot_ptr src);
old_cap <- KHeap_D.get_cap (transform_cslot_ptr sibling);
y <- assert (old_cap = cdl_cap.NullCap);
y <- CSpace_D.set_untyped_cap_as_full src_cap (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do src_cap <- CSpaceAcc_A.get_cap src;
old_cap <- CSpaceAcc_A.get_cap sibling;
y <- assert (old_cap = cap.NullCap);
y <- CSpace_A.set_untyped_cap_as_full src_cap cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_cap)\<rparr>)
od)
 2. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?Q19 s
 3. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?Q'19 s' proof (prove)
goal (7 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>src_cap = transform_cap src_capa; old_cap = transform_cap rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R29 src_cap src_capa old_cap) (?R'29 src_cap src_capa rv') (do y <- assert (old_cap = cdl_cap.NullCap);
y <- CSpace_D.set_untyped_cap_as_full src_cap (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do y <- assert (rv' = cap.NullCap);
y <- CSpace_A.set_untyped_cap_as_full src_capa cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>)
od)
 2. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>?R29 src_cap src_capa\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>?R'29 src_cap src_capa\<rbrace>
 4. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 5. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 6. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (7 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>src_cap = transform_cap src_capa; old_cap = transform_cap rv'; old_cap = cdl_cap.NullCap; rv' = cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc (?P40 src_cap src_capa old_cap) (?P'44 src_cap src_capa rv') (do y <- CSpace_D.set_untyped_cap_as_full src_cap (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do y <- CSpace_A.set_untyped_cap_as_full src_capa cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>)
od)
 2. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ?P40 src_cap src_capa old_cap s\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> ?P'44 src_cap src_capa rv' s\<rbrace>
 4. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 5. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 6. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (7 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>src_cap = transform_cap src_capa; old_cap = transform_cap rv'; old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres dc (?P47 src_cap src_capa old_cap) (?P'44 src_cap src_capa rv') (do y <- CSpace_D.set_untyped_cap_as_full src_cap (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do y <- CSpace_A.set_untyped_cap_as_full src_capa cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>)
od)
 2. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> (?P47 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> ?P'44 src_cap src_capa rv' s\<rbrace>
 4. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 5. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 6. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (7 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> dcorres dc (?P47 (transform_cap src_capa) src_capa cdl_cap.NullCap) (?P'44 (transform_cap src_capa) src_capa cap.NullCap) (do y <- CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src);
y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (set_parent (transform_cslot_ptr sibling))
od) (do y <- CSpace_A.set_untyped_cap_as_full src_capa cap src;
y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>)
od)
 2. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> (?P47 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> ?P'44 src_cap src_capa rv' s\<rbrace>
 4. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 5. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 6. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (9 subgoals):
 1. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R48 src_cap src_capa old_cap rv' y) (?R'48 src_cap src_capa old_cap rv' ya) (do y <- KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap);
a <- gets (opt_parent (transform_cslot_ptr src));
case a of None \<Rightarrow> return () | Some a \<Rightarrow> set_parent (transform_cslot_ptr sibling) a
od) (do y <- CSpaceAcc_A.set_cap cap sibling;
modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>)
od)
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>?R48 src_cap src_capa old_cap rv'\<rbrace>
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>?R'48 src_cap src_capa old_cap rv'\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 6. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 7. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (11 subgoals):
 1. \<And>src_cap src_capa old_cap rv' y ya rv rv'a. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya; dc rv rv'a\<rbrakk> \<Longrightarrow> dcorres dc (?R61 src_cap src_capa old_cap rv' y ya rv) (?R'61 src_cap src_capa old_cap rv' y ya rv'a) (do a <- gets (opt_parent (transform_cslot_ptr src));
case a of None \<Rightarrow> return () | Some a \<Rightarrow> set_parent (transform_cslot_ptr sibling) a
od) (modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>?R61 src_cap src_capa old_cap rv' y ya\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>?R'61 src_cap src_capa old_cap rv' y ya\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_cap src_capa old_cap rv' y ya rv rv'a. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya; dc rv rv'a\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (?P74 src_cap src_capa old_cap rv' y ya rv'a) (gets (opt_parent (transform_cslot_ptr src)) >>= case_option (return ()) (\<lambda>parent. modify (\<lambda>s. s\<lparr>cdl_cdt := (cdl_cdt s)(transform_cslot_ptr sibling \<mapsto> parent)\<rparr>))) (modify (\<lambda>s. cdt_update (\<lambda>cdt. cdt(sibling := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src)) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src) | Some p \<Rightarrow> (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling))(src := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) src, p := if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) sibling)) p)) s)\<lparr>is_original_cap := (is_original_cap s)(sibling := is_cap_revocable cap src_capa)\<rparr>))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ?P74 src_cap src_capa old_cap rv' y ya rv'a s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa. dcorres dc (\<lambda>_. True) (?P74 (transform_cap src_capa) src_capa cdl_cap.NullCap cap.NullCap () () ()) (modify (\<lambda>s. (case opt_parent (transform_cslot_ptr src) s of None \<Rightarrow> id | Some parent \<Rightarrow> \<lambda>s. s\<lparr>cdl_cdt := (cdl_cdt s)(transform_cslot_ptr sibling \<mapsto> parent)\<rparr>) s)) (modify (\<lambda>s. cdt_update (\<lambda>cdt a. if a = sibling then if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then Some src else cdt src else cdt a) (cdt_list_update (\<lambda>_. case cdt s src of None \<Rightarrow> \<lambda>a. if a = src then if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) a | Some p \<Rightarrow> \<lambda>a. if a = p then if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) p else if src \<noteq> sibling then list_insert_after ((case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) p) src sibling else sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) p else if a = src then if should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) src else (case cdt s sibling of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s p) sibling else cdt_list s a) a) s)\<lparr>is_original_cap := \<lambda>x. (x = sibling \<longrightarrow> is_cap_revocable cap src_capa) \<and> (x \<noteq> sibling \<longrightarrow> is_original_cap s x)\<rparr>))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ?P74 src_cap src_capa old_cap rv' y ya rv'a s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s s'. \<lbrakk>True; ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (?orig'117 (transform_cap src_capa) src_capa cdl_cap.NullCap cap.NullCap () () ())) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((case opt_parent (transform_cslot_ptr src) s of None \<Rightarrow> id | Some parent \<Rightarrow> \<lambda>s. s\<lparr>cdl_cdt := (cdl_cdt s)(transform_cslot_ptr sibling \<mapsto> parent)\<rparr>) s, cdt_update (\<lambda>cdt a. if a = sibling then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then Some src else cdt src else cdt a) (cdt_list_update (\<lambda>_. case cdt s' src of None \<Rightarrow> \<lambda>a. if a = src then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a | Some p \<Rightarrow> \<lambda>a. if a = p then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if src \<noteq> sibling then list_insert_after ((case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p) src sibling else sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if a = src then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a) s')\<lparr>is_original_cap := \<lambda>x. (x = sibling \<longrightarrow> is_cap_revocable cap src_capa) \<and> (x \<noteq> sibling \<longrightarrow> is_original_cap s' x)\<rparr>) \<in> {ss'. transform (snd ss') = fst ss'}
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (?orig'117 src_cap src_capa old_cap rv' y ya rv'a)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (?orig'117 (transform_cap src_capa) src_capa cdl_cap.NullCap cap.NullCap () () ()); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> transform (cdt_update (\<lambda>cdt a. if a = sibling then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then Some src else cdt src else cdt a) (cdt_list_update (\<lambda>_. case cdt s' src of None \<Rightarrow> \<lambda>a. if a = src then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a | Some p \<Rightarrow> \<lambda>a. if a = p then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if src \<noteq> sibling then list_insert_after ((case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p) src sibling else sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if a = src then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) then sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a) s')\<lparr>is_original_cap := \<lambda>x. (x = sibling \<longrightarrow> is_cap_revocable cap src_capa) \<and> (x \<noteq> sibling \<longrightarrow> is_original_cap s' x)\<rparr>) = (case opt_parent (transform_cslot_ptr src) (transform s') of None \<Rightarrow> id | Some parent \<Rightarrow> \<lambda>s. s\<lparr>cdl_cdt := (cdl_cdt s)(transform_cslot_ptr sibling \<mapsto> parent)\<rparr>) (transform s')
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (?orig'117 src_cap src_capa old_cap rv' y ya rv'a)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> transform (cdt_update (\<lambda>cdt a. if a = sibling then cdt src else cdt a) (cdt_list_update (\<lambda>_. case cdt s' src of None \<Rightarrow> \<lambda>a. if a = src then (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a | Some p \<Rightarrow> \<lambda>a. if a = p then if should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa) \<and> p \<noteq> src then (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if src \<noteq> sibling then list_insert_after ((case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p) src sibling else sibling # (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) p else if a = src then (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) src else (case cdt s' sibling of None \<Rightarrow> cdt_list s' | Some p \<Rightarrow> \<lambda>a. if a = p then list_remove (cdt_list s' p) sibling else cdt_list s' a) a) s')\<lparr>is_original_cap := \<lambda>x. (x = sibling \<longrightarrow> is_cap_revocable cap src_capa) \<and> (x \<noteq> sibling \<longrightarrow> is_original_cap s' x)\<rparr>) = (case opt_parent (transform_cslot_ptr src) (transform s') of None \<Rightarrow> id | Some parent \<Rightarrow> \<lambda>s. s\<lparr>cdl_cdt := (cdl_cdt s)(transform_cslot_ptr sibling \<mapsto> parent)\<rparr>) (transform s')
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> (map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = None \<longrightarrow> map_lift_over transform_cslot_ptr (\<lambda>a. if a = sibling then cdt s' src else cdt s' a) = map_lift_over transform_cslot_ptr (cdt s')) \<and> (\<forall>a b. map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = Some (a, b) \<longrightarrow> map_lift_over transform_cslot_ptr (\<lambda>a. if a = sibling then cdt s' src else cdt s' a) = (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling \<mapsto> (a, b)))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> (map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = None \<longrightarrow> map_lift_over transform_cslot_ptr ((cdt s')(sibling := cdt s' src)) = map_lift_over transform_cslot_ptr (cdt s')) \<and> (\<forall>a b. map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = Some (a, b) \<longrightarrow> map_lift_over transform_cslot_ptr ((cdt s')(sibling := cdt s' src)) = (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling \<mapsto> (a, b)))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))\<rbrakk> \<Longrightarrow> (map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = None \<longrightarrow> map_lift_over transform_cslot_ptr ((cdt s')(sibling := cdt s' src)) = map_lift_over transform_cslot_ptr (cdt s')) \<and> (\<forall>a b. map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr src) = Some (a, b) \<longrightarrow> map_lift_over transform_cslot_ptr ((cdt s')(sibling := cdt s' src)) = (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling \<mapsto> (a, b)))
 2. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 6. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 8. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 9. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 10. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))\<rbrakk> \<Longrightarrow> (None = map_option transform_cslot_ptr (cdt s' src) \<longrightarrow> (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling := map_option transform_cslot_ptr (cdt s' src)) = map_lift_over transform_cslot_ptr (cdt s')) \<and> (\<forall>a b. Some (a, b) = map_option transform_cslot_ptr (cdt s' src) \<longrightarrow> (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling := map_option transform_cslot_ptr (cdt s' src)) = (map_lift_over transform_cslot_ptr (cdt s'))(transform_cslot_ptr sibling \<mapsto> (a, b)))
 2. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 6. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 8. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 9. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 10. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; inj_on transform_cslot_ptr (insert src (insert sibling (dom (cdt s') \<union> ran (cdt s'))))\<rbrakk> \<Longrightarrow> cdt s' src = None \<longrightarrow> (\<exists>a b. (a, b) = transform_cslot_ptr sibling) \<longrightarrow> None = map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr sibling)
 2. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 6. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 8. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 9. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 10. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; inj_on transform_cslot_ptr (insert src (insert sibling (dom (cdt s') \<union> ran (cdt s'))))\<rbrakk> \<Longrightarrow> cdt s' src = None \<longrightarrow> (\<exists>a b. (a, b) = transform_cslot_ptr sibling) \<longrightarrow> map_lift_over transform_cslot_ptr (cdt s') (transform_cslot_ptr sibling) = None
 2. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 6. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 8. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 9. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 10. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; inj_on transform_cslot_ptr (insert src (insert sibling (dom (cdt s') \<union> ran (cdt s'))))\<rbrakk> \<Longrightarrow> cdt s' src = None \<longrightarrow> (\<exists>a b. (a, b) = transform_cslot_ptr sibling) \<longrightarrow> None = map_option transform_cslot_ptr (cdt s' sibling)
 2. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 4. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 6. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 8. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 9. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 10. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s'. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None\<rbrakk> \<Longrightarrow> inj_on transform_cslot_ptr ({src, sibling} \<union> dom (cdt s') \<union> ran (cdt s'))
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>src_capa s' x. \<lbrakk>\<not> should_be_parent_of src_capa (is_original_cap s' src) cap (is_cap_revocable cap src_capa); cte_wp_at (\<lambda>_. True) src s'; cte_wp_at (\<lambda>_. True) sibling s'; mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s') (cdt s'); cdt s' sibling = None; x \<in> {src, sibling} \<union> dom (cdt s') \<union> ran (cdt s')\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) x s'
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 3. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 5. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 7. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 8. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 9. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q65 src_cap src_capa old_cap rv' y\<rbrace> KHeap_D.set_cap (transform_cslot_ptr sibling) (transform_cap cap) \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>src_cap src_capa old_cap rv' y ya. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'67 src_cap src_capa old_cap rv' ya\<rbrace> CSpaceAcc_A.set_cap cap sibling \<lbrace>\<lambda>rv'a s. cdt s sibling = None \<and> cte_wp_at (\<lambda>_. True) sibling s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> ((\<lambda>s. \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa)) and cte_wp_at (\<lambda>_. True) src and cte_wp_at (\<lambda>_. True) sibling and (\<lambda>s. mdb_cte_at (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s)) and (\<lambda>s. cdt s sibling = None)) s\<rbrace>
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q56 (transform_cap src_capa) src_capa cdl_cap.NullCap\<rbrace> CSpace_D.set_untyped_cap_as_full (transform_cap src_capa) (transform_cap cap) (transform_cslot_ptr src) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q65 src_cap src_capa old_cap rv' y\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'54 (transform_cap src_capa) src_capa cap.NullCap\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>ya. (\<lambda>s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'67 src_cap src_capa old_cap rv' ya\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and ?Q56 src_cap src_capa old_cap and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and ?Q'54 src_cap src_capa rv') s\<rbrace>
 7. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 8. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (8 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'441 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> ?P'441 src_cap src_capa rv' a) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 5. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 6. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (9 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<lbrace>?P'477 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpaceAcc_A.set_cap (max_free_index_update src_capa) src \<lbrace>\<lambda>rv s. mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R446 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> ?P'477 src_cap src_capa rv' a) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R446 src_cap src_capa rv' a)) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 6. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 7. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (10 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<lbrace>?P'477 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpaceAcc_A.set_cap (max_free_index_update src_capa) src \<lbrace>\<lambda>r s. cdt s sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrace>
 2. \<And>src_cap src_capa old_cap rv' rv s. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap; cdt s sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R446 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 4. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 6. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> ?P'477 src_cap src_capa rv' a) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R446 src_cap src_capa rv' a)) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 7. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 8. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 10. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (9 subgoals):
 1. \<And>src_cap src_capa old_cap rv' rv s. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap; cdt s sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R446 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R446 src_cap src_capa rv' a)) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 6. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 7. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (9 subgoals):
 1. \<And>s deva ptra sza idxa a b aa ba. \<lbrakk>cdt s sibling = None; cap = cap.UntypedCap deva ptra sza idxa; ptra \<le> ptra + 2 ^ sza - 1 \<longrightarrow> \<not> is_original_cap s sibling; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> cap.NullCap \<noteq> cap) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap); cdt s (aa, ba) = Some (a, b)\<rbrakk> \<Longrightarrow> ((a, b) \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap)) \<and> ((aa, ba) \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap))
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R446 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R446 src_cap src_capa rv' a)) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 6. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 7. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (8 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R446 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa\<rbrakk> \<Longrightarrow> \<lbrace>?P'436 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpace_A.set_untyped_cap_as_full src_capa cap src \<lbrace>\<lambda>rv s. src \<noteq> sibling \<longrightarrow> valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R446 src_cap src_capa rv' a)) \<and> ?P'436 src_cap src_capa rv' a)) s\<rbrace>
 5. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 6. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (8 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<lbrace>?P'633 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpaceAcc_A.set_cap (max_free_index_update src_capa) src \<lbrace>\<lambda>rv s. mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R602 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> ?P'633 src_cap src_capa rv' a) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R602 src_cap src_capa rv' a)))) s\<rbrace>
 5. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 6. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (9 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<lbrace>?P'633 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> CSpaceAcc_A.set_cap (max_free_index_update src_capa) src \<lbrace>\<lambda>r s. cdt s sibling = None \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrace>
 2. \<And>src_cap src_capa old_cap rv' rv s. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap; cdt s sibling = None \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None
 3. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R602 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 5. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> ?P'633 src_cap src_capa rv' a) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R602 src_cap src_capa rv' a)))) s\<rbrace>
 6. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 7. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 9. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (8 subgoals):
 1. \<And>src_cap src_capa old_cap rv' rv s. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap; cdt s sibling = None \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R602 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap a src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R602 src_cap src_capa rv' a)))) s\<rbrace>
 5. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 6. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (8 subgoals):
 1. \<And>s deva ptra sza idxa capa a b aa ba. \<lbrakk>cdt s sibling = None; cap = cap.UntypedCap deva ptra sza idxa; caps_of_state s src = Some capa; ptra \<le> ptra + 2 ^ sza - 1 \<longrightarrow> \<not> is_original_cap s src; \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> cap.NullCap \<noteq> cap) \<and> (\<exists>cap. caps_of_state s (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap); cdt s (aa, ba) = Some (a, b)\<rbrakk> \<Longrightarrow> ((a, b) \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s (a, b) = Some cap)) \<and> ((aa, ba) \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s (aa, ba) = Some cap))
 2. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R602 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 4. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap a src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R602 src_cap src_capa rv' a)))) s\<rbrace>
 5. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 6. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 8. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (7 subgoals):
 1. \<And>src_cap src_capa old_cap rv'. \<lbrakk>old_cap = cdl_cap.NullCap; rv' = cap.NullCap; src_cap = transform_cap src_capa; \<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap)\<rbrakk> \<Longrightarrow> \<lbrace>?R602 (transform_cap src_capa) src_capa (ds_id cap.NullCap)\<rbrace> return () \<lbrace>\<lambda>rv s. valid_idle s \<and> fst sibling \<noteq> idle_thread s \<and> valid_etcbs s \<and> cdt s sibling = None \<and> (\<exists>cap. caps_of_state s sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s) \<and> \<not> should_be_parent_of src_capa (is_original_cap s src) cap (is_cap_revocable cap src_capa) \<and> (\<exists>cap. caps_of_state s src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s x = Some cap)) (cdt s) \<and> cdt s sibling = None\<rbrace>
 2. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q31 src_cap\<rbrace> KHeap_D.get_cap (transform_cslot_ptr sibling) \<lbrace>\<lambda>old_cap s. old_cap = cdl_cap.NullCap \<and> ((\<lambda>_. True) and (\<lambda>a. True \<and> True) and (\<lambda>s. src_cap = transform_cap src_capa)) s\<rbrace>
 3. \<And>src_cap src_capa. src_cap = transform_cap src_capa \<Longrightarrow> \<lbrace>?Q'33 src_capa\<rbrace> CSpaceAcc_A.get_cap sibling \<lbrace>\<lambda>rv' s. rv' = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) src_capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of src_capa (is_original_cap a sibling) cap (is_cap_revocable cap src_capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update src_capa)) src = Some cap) \<and> \<not> should_be_parent_of src_capa (is_original_cap a src) cap (cap_insert_dest_original cap src_capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update src_capa)) \<and> (\<not> (Structures_A.is_untyped_cap src_capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of src_capa = obj_ref_of cap \<and> cap_bits_untyped src_capa = cap_bits_untyped cap) \<longrightarrow> ?R602 src_cap src_capa rv' a)))) s\<rbrace>
 4. \<lbrace>?Q23\<rbrace> KHeap_D.get_cap (transform_cslot_ptr src) \<lbrace>\<lambda>src_cap. (\<lambda>_. True) and ?Q31 src_cap\<rbrace>
 5. \<lbrace>?Q'23\<rbrace> CSpaceAcc_A.get_cap src \<lbrace>\<lambda>src_capa. valid_idle and not_idle_thread (fst sibling) and valid_etcbs and ?Q'33 src_capa\<rbrace>
 6. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q23) s
 7. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and ?Q'23) s' proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; transform s' = s\<rbrakk> \<Longrightarrow> (\<exists>y. opt_cap (transform_cslot_ptr src) s = Some y) \<longrightarrow> (\<exists>y. opt_cap (transform_cslot_ptr sibling) s = Some y) \<longrightarrow> the (opt_cap (transform_cslot_ptr sibling) s) = cdl_cap.NullCap
 2. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (valid_idle and not_idle_thread (fst sibling) and valid_etcbs and (\<lambda>s. \<forall>capb. cte_wp_at ((=) capb) sibling s \<longrightarrow> capb = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) src = Some cap) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (is_cap_revocable cap capa) \<and> (\<exists>cap. caps_of_state a src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)))) s)) s)) s' proof (prove)
goal (2 subgoals):
 1. \<And>s' y ya. \<lbrakk>cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s'; cte_wp_at ((=) cap.NullCap) sibling s'; cte_wp_at (\<lambda>_. True) src s'; not_idle_thread (fst sibling) s'; not_idle_thread (fst src) s'; valid_etcbs s'; valid_mdb s'; valid_idle s'; valid_objs s'; cap_aligned cap; opt_cap (transform_cslot_ptr src) (transform s') = Some y; opt_cap (transform_cslot_ptr sibling) (transform s') = Some ya\<rbrakk> \<Longrightarrow> ya = cdl_cap.NullCap
 2. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (valid_idle and not_idle_thread (fst sibling) and valid_etcbs and (\<lambda>s. \<forall>capb. cte_wp_at ((=) capb) sibling s \<longrightarrow> capb = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) src = Some cap) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (is_cap_revocable cap capa) \<and> (\<exists>cap. caps_of_state a src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)))) s)) s)) s' proof (prove)
goal (2 subgoals):
 1. \<And>s' y ya. \<lbrakk>cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s'; cte_wp_at ((=) cap.NullCap) sibling s'; cte_wp_at (\<lambda>_. True) src s'; fst sibling \<noteq> idle_thread s'; fst src \<noteq> idle_thread s'; valid_etcbs s'; valid_mdb s'; valid_idle s'; valid_objs s'; cap_aligned cap; opt_cap (transform_cslot_ptr src) (transform s') = Some y; opt_cap (transform_cslot_ptr sibling) (transform s') = Some ya\<rbrakk> \<Longrightarrow> ya = cdl_cap.NullCap
 2. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (valid_idle and not_idle_thread (fst sibling) and valid_etcbs and (\<lambda>s. \<forall>capb. cte_wp_at ((=) capb) sibling s \<longrightarrow> capb = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) src = Some cap) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (is_cap_revocable cap capa) \<and> (\<exists>cap. caps_of_state a src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)))) s)) s)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>True; cte_wp_at (\<lambda>cap'. \<not> should_be_parent_of cap' (is_original_cap s' src) cap (cap_insert_dest_original cap cap')) src s' \<and> cte_wp_at ((=) cap.NullCap) sibling s' \<and> cte_wp_at (\<lambda>_. True) src s' \<and> not_idle_thread (fst sibling) s' \<and> not_idle_thread (fst src) s' \<and> valid_etcbs s' \<and> valid_mdb s' \<and> valid_idle s' \<and> valid_objs s' \<and> cap_aligned cap; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst src) and valid_etcbs and (\<lambda>s. \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> (valid_idle and not_idle_thread (fst sibling) and valid_etcbs and (\<lambda>s. \<forall>capb. cte_wp_at ((=) capb) sibling s \<longrightarrow> capb = cap.NullCap \<longrightarrow> (K (cap_aligned cap) and cte_wp_at ((=) capa) src and valid_objs and not_idle_thread (fst src) and valid_idle and valid_etcbs and (\<lambda>a. (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) sibling = Some cap) \<and> cdt a sibling = None \<and> (\<exists>cap. ((caps_of_state a)(src \<mapsto> max_free_index_update capa)) src = Some cap) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) a) (cdt a) \<and> (src \<in> dom (cdt a) \<union> ran (cdt a) \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> (\<not> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap) \<longrightarrow> valid_idle a \<and> fst sibling \<noteq> idle_thread a \<and> valid_etcbs a \<and> cdt a sibling = None \<and> (\<exists>cap. caps_of_state a sibling = Some cap) \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt a) \<and> \<not> should_be_parent_of capa (is_original_cap a src) cap (is_cap_revocable cap capa) \<and> (\<exists>cap. caps_of_state a src = Some cap) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state a x = Some cap)) (cdt a) \<and> cdt a sibling = None)))) s)) s)) s' proof (prove)
goal (1 subgoal):
 1. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' src) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst src \<noteq> idle_thread s'; valid_etcbs s'; valid_mdb s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' src = Some capa\<rbrakk> \<Longrightarrow> (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> cdt s' sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (\<lambda>a. \<exists>cap. caps_of_state s' a = Some cap \<and> cap.NullCap \<noteq> cap) (cdt s') \<and> (sibling \<in> dom (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa) \<and> (sibling \<in> ran (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> Structures_A.is_untyped_cap cap \<longrightarrow> Structures_A.is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s') \<and> \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' x = Some cap)) (cdt s') \<and> cdt s' sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>a. \<exists>cap. caps_of_state s' a = Some cap \<and> cap.NullCap \<noteq> cap) (cdt s') \<and> (src \<in> dom (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa) \<and> (src \<in> ran (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> Structures_A.is_untyped_cap cap \<longrightarrow> Structures_A.is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s') \<and> \<not> should_be_parent_of capa (is_original_cap s' src) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' x = Some cap)) (cdt s') \<and> cdt s' sibling = None)) proof (prove)
goal (1 subgoal):
 1. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' src) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst src \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' src = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s')\<rbrakk> \<Longrightarrow> (src = sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> cdt s' sibling = None \<and> \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa) \<and> mdb_cte_at (\<lambda>a. \<exists>cap. caps_of_state s' a = Some cap \<and> cap.NullCap \<noteq> cap) (cdt s') \<and> (sibling \<in> dom (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa) \<and> (sibling \<in> ran (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> Structures_A.is_untyped_cap cap \<longrightarrow> Structures_A.is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s') \<and> \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' x = Some cap)) (cdt s') \<and> cdt s' sibling = None)) \<and> (src \<noteq> sibling \<longrightarrow> (Structures_A.is_untyped_cap capa \<and> Structures_A.is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>a. \<exists>cap. caps_of_state s' a = Some cap \<and> cap.NullCap \<noteq> cap) (cdt s') \<and> (src \<in> dom (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa) \<and> (src \<in> ran (cdt s') \<longrightarrow> cap.NullCap \<noteq> max_free_index_update capa)) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> Structures_A.is_untyped_cap cap \<longrightarrow> Structures_A.is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> cdt s' sibling = None \<and> mdb_cte_at (\<lambda>y. (y = sibling \<longrightarrow> cap.NullCap \<noteq> cap) \<and> (y \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' y = Some cap \<and> cap.NullCap \<noteq> cap))) (cdt s') \<and> \<not> should_be_parent_of capa (is_original_cap s' src) cap (is_cap_revocable cap capa) \<and> mdb_cte_at (\<lambda>x. x \<noteq> sibling \<longrightarrow> (\<exists>cap. caps_of_state s' x = Some cap)) (cdt s') \<and> cdt s' sibling = None)) proof (prove)
goal (145 subgoals):
 1. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; cdt s' (a, b) = Some (aa, ba)\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap
 2. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; cdt s' (a, b) = Some (aa, ba)\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap \<and> cap.NullCap \<noteq> cap
 3. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; sibling \<in> ran (cdt s'); cap.NullCap = max_free_index_update capa\<rbrakk> \<Longrightarrow> False
 4. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' (aa, ba) = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' (aa, ba)) cap.NullCap (cap_insert_dest_original cap.NullCap capa); fst (aa, ba) \<noteq> idle_thread s'; fst (aa, ba) \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap.NullCap; caps_of_state s' (aa, ba) = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' (aa, ba) = None; src = (aa, ba); obj_ref_of capa \<noteq> obj_ref_of cap.NullCap; cdt s' (a, b) = Some (aa, ba); sibling = (aa, ba); cap = cap.NullCap\<rbrakk> \<Longrightarrow> False
 5. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (aa, ba) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap
 6. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' (a, b) = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' (a, b)) cap.NullCap (cap_insert_dest_original cap.NullCap capa); fst (a, b) \<noteq> idle_thread s'; fst (a, b) \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap.NullCap; caps_of_state s' (a, b) = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' (a, b) = None; src = (a, b); obj_ref_of capa \<noteq> obj_ref_of cap.NullCap; cdt s' (a, b) = Some (aa, ba); sibling = (a, b); cap = cap.NullCap\<rbrakk> \<Longrightarrow> False
 7. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (a, b) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap \<and> cap.NullCap \<noteq> cap
 8. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; should_be_parent_of capa (is_original_cap s' sibling) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> False
 9. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (aa, ba) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap
 10. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (a, b) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap
A total of 145 subgoals... proof (prove)
goal (145 subgoals):
 1. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; cdt s' (a, b) = Some (aa, ba)\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap
 2. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; cdt s' (a, b) = Some (aa, ba)\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap \<and> cap.NullCap \<noteq> cap
 3. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; Structures_A.is_untyped_cap capa; Structures_A.is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; sibling \<in> ran (cdt s'); cap.NullCap = max_free_index_update capa\<rbrakk> \<Longrightarrow> False
 4. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' (aa, ba) = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' (aa, ba)) cap.NullCap (cap_insert_dest_original cap.NullCap capa); fst (aa, ba) \<noteq> idle_thread s'; fst (aa, ba) \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap.NullCap; caps_of_state s' (aa, ba) = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' (aa, ba) = None; src = (aa, ba); obj_ref_of capa \<noteq> obj_ref_of cap.NullCap; cdt s' (a, b) = Some (aa, ba); sibling = (aa, ba); cap = cap.NullCap\<rbrakk> \<Longrightarrow> False
 5. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (aa, ba) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap \<and> cap.NullCap \<noteq> cap
 6. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' (a, b) = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' (a, b)) cap.NullCap (cap_insert_dest_original cap.NullCap capa); fst (a, b) \<noteq> idle_thread s'; fst (a, b) \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap.NullCap; caps_of_state s' (a, b) = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' (a, b) = None; src = (a, b); obj_ref_of capa \<noteq> obj_ref_of cap.NullCap; cdt s' (a, b) = Some (aa, ba); sibling = (a, b); cap = cap.NullCap\<rbrakk> \<Longrightarrow> False
 7. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (a, b) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap \<and> cap.NullCap \<noteq> cap
 8. \<And>s' capa. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; should_be_parent_of capa (is_original_cap s' sibling) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> False
 9. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (aa, ba) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (aa, ba) = Some cap
 10. \<And>s' capa a b aa ba. \<lbrakk>caps_of_state s' sibling = Some cap.NullCap; \<not> should_be_parent_of capa (is_original_cap s' sibling) cap (cap_insert_dest_original cap capa); fst sibling \<noteq> idle_thread s'; fst sibling \<noteq> idle_thread s'; valid_etcbs s'; valid_idle s'; valid_objs s'; cap_aligned cap; caps_of_state s' sibling = Some capa; mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s') (cdt s'); untyped_mdb (cdt s') (caps_of_state s'); descendants_inc (cdt s') (caps_of_state s'); no_mloop (cdt s'); untyped_inc (cdt s') (caps_of_state s'); ut_revocable (is_original_cap s') (caps_of_state s'); irq_revocable (is_original_cap s') (caps_of_state s'); reply_master_revocable (is_original_cap s') (caps_of_state s'); reply_mdb (cdt s') (caps_of_state s'); cdt s' sibling = None; src = sibling; obj_ref_of capa \<noteq> obj_ref_of cap; cdt s' (a, b) = Some (aa, ba); (a, b) \<noteq> sibling\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s' (a, b) = Some cap
A total of 145 subgoals...