theory Untyped_R

lemma insertNewCap_corres:
notes if_cong[cong del] if_weak_cong[cong]
shows
  "\<lbrakk> cref' = cte_map (fst tup)
     \<and> cap_relation (default_cap tp (snd tup) sz d) cap \<rbrakk> \<Longrightarrow>
   corres dc
     (cte_wp_at ((=) cap.NullCap) (fst tup) and pspace_aligned
        and pspace_distinct and valid_objs and valid_mdb and valid_list
        and cte_wp_at ((\<noteq>) cap.NullCap) p)
     (cte_wp_at' (\<lambda>c. cteCap c = NullCap) cref' and
      cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> sameRegionAs (cteCap cte) cap) (cte_map p)
       and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs'
       and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))
     (create_cap tp sz p d tup)
     (insertNewCap (cte_map p) cref' cap)" apply (cases tup,
         clarsimp simp add: create_cap_def insertNewCap_def
                            liftM_def) apply (rule corres_symb_exec_r [OF _ getCTE_sp])+ prefer 3 apply (rule no_fail_pre, wp) apply (clarsimp elim!: cte_wp_at_weakenE') prefer 4 apply (rule no_fail_pre, wp) apply (clarsimp elim!: cte_wp_at_weakenE') apply (rule corres_assert_assume) prefer 2 apply (case_tac oldCTE) apply (clarsimp simp: cte_wp_at_ctes_of valid_mdb'_def valid_mdb_ctes_def
                           valid_nullcaps_def) apply (erule allE)+ apply (erule (1) impE) apply (simp add: initMDBNode_def) apply clarsimp apply (rule_tac F="capClass cap = PhysicalClass" in corres_req) apply (clarsimp simp: cte_wp_at_ctes_of isCap_simps) apply (drule sameRegionAs_classes, simp) apply (rule corres_caps_decomposition) prefer 3 apply wp+ apply (rule hoare_post_imp, simp) apply (wp | assumption)+ defer apply ((wp | simp)+)[1] apply (simp add: create_cap_ext_def set_cdt_list_def update_cdt_list_def bind_assoc) apply ((wp | simp)+)[1] apply (wp updateMDB_ctes_of_cases
                                                  | simp add: o_def split del: if_split)+ apply (clarsimp simp: cdt_relation_def cte_wp_at_ctes_of
                     split del: if_split cong: if_cong simp del: id_apply) apply (subst if_not_P, erule(1) valid_mdbD3') apply (case_tac x, case_tac oldCTE) apply (subst bluhr_descendants_of') apply (rule mdb_insert_again_child.intro) apply (rule mdb_insert_again.intro) apply (rule mdb_ptr.intro) apply (simp add: valid_mdb'_def vmdb_def) apply (rule mdb_ptr_axioms.intro) apply simp apply (rule mdb_ptr.intro) apply (simp add: valid_mdb'_def vmdb_def) apply (rule mdb_ptr_axioms.intro) apply fastforce apply (rule mdb_insert_again_axioms.intro) apply (clarsimp simp: nullPointer_def)+ apply (erule (1) ctes_of_valid_cap') apply (simp add: valid_mdb'_def valid_mdb_ctes_def) apply clarsimp apply (rule mdb_insert_again_child_axioms.intro) apply (clarsimp simp: isMDBParentOf_def) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: valid_mdb'_def valid_mdb_ctes_def
                                   ut_revocable'_def) apply (fold fun_upd_def) apply (subst descendants_of_insert_child') apply (erule(1) mdb_Null_descendants) apply (clarsimp simp: cte_wp_at_def) apply (erule(1) mdb_Null_None) apply (subgoal_tac "cte_at (aa, bb) s") prefer 2 apply (drule not_sym, clarsimp simp: cte_wp_at_caps_of_state split: if_split_asm) apply (subst descendants_of_eq' [OF _ cte_wp_at_cte_at], assumption+) apply (clarsimp simp: state_relation_def) apply assumption+ apply (subst cte_map_eq_subst [OF _ cte_wp_at_cte_at], assumption+) apply (simp add: mdb_relation_simp) defer apply (clarsimp split del: if_split)+ apply (clarsimp simp add: revokable_relation_def cte_wp_at_ctes_of
                        split del: if_split) apply simp apply (rule conjI) apply clarsimp apply (elim modify_map_casesE) apply ((clarsimp split: if_split_asm cong: conj_cong
                              simp: cte_map_eq_subst cte_wp_at_cte_at
                                    revokable_relation_simp)+)[4] apply clarsimp apply (subgoal_tac "null_filter (caps_of_state s) (aa, bb) \<noteq> None") prefer 2 apply (clarsimp simp: null_filter_def cte_wp_at_caps_of_state split: if_split_asm) apply (subgoal_tac "cte_at (aa,bb) s") prefer 2 apply clarsimp apply (drule null_filter_caps_of_stateD) apply (erule cte_wp_cte_at) apply (elim modify_map_casesE) apply (clarsimp split: if_split_asm cong: conj_cong
                            simp: cte_map_eq_subst cte_wp_at_cte_at revokable_relation_simp)+ apply (clarsimp simp: state_relation_def ghost_relation_of_heap)+ apply wp+ apply (rule corres_guard_imp) apply (rule corres_underlying_symb_exec_l [OF gets_symb_exec_l]) apply (rule corres_underlying_symb_exec_l [OF gets_symb_exec_l]) apply (rule corres_underlying_symb_exec_l [OF set_cdt_symb_exec_l]) apply (rule corres_underlying_symb_exec_l [OF do_ext_op_update_cdt_list_symb_exec_l']) apply (rule corres_underlying_symb_exec_l [OF set_original_symb_exec_l]) apply (rule corres_cong[OF refl refl _ refl refl, THEN iffD1]) apply (rule bind_return[THEN fun_cong]) apply (rule corres_split) apply (rule setCTE_corres; simp) apply (subst bind_return[symmetric],
                   rule corres_split) apply (simp add: dc_def[symmetric]) apply (rule updateMDB_symb_exec_r) apply (simp add: dc_def[symmetric]) apply (rule corres_split_noop_rhs[OF updateMDB_symb_exec_r]) apply (rule updateNewFreeIndex_noop_psp_corres) apply (wp getCTE_wp set_cdt_valid_objs set_cdt_cte_at
                        hoare_weak_lift_imp | simp add: o_def)+ apply (clarsimp simp: cte_wp_at_cte_at) apply (clarsimp simp: cte_wp_at_ctes_of no_0_def valid_mdb'_def
                         valid_mdb_ctes_def) apply (rule conjI, clarsimp) apply clarsimp apply (erule (2) valid_dlistEn) apply simp apply(simp only: cdt_list_relation_def valid_mdb_def2) apply(subgoal_tac "finite_depth (cdt s)") prefer 2 apply(simp add: finite_depth valid_mdb_def2[simplified,symmetric]) apply(intro impI allI) apply(subgoal_tac "mdb_insert_abs (cdt s) p (a, b)") prefer 2 apply(clarsimp simp: cte_wp_at_caps_of_state) apply(rule mdb_insert_abs.intro) apply(clarsimp) apply(erule (1) mdb_cte_at_Null_None) apply (erule (1) mdb_cte_at_Null_descendants) apply(subgoal_tac "no_0 (ctes_of s')") prefer 2 apply(simp add: valid_mdb_ctes_def valid_mdb'_def) apply simp apply (elim conjE) apply (case_tac "cdt s (a,b)") prefer 2 apply (simp add: mdb_insert_abs_def) apply simp apply(case_tac x) apply(simp add: cte_wp_at_ctes_of) apply(simp add: mdb_insert_abs.next_slot split del: if_split) apply(case_tac "c=p") apply(simp) apply(clarsimp simp: modify_map_def) apply(case_tac z) apply(fastforce split: if_split_asm) apply(case_tac "c = (a, b)") apply(simp) apply(case_tac "next_slot p (cdt_list s) (cdt s)") apply(simp) apply(simp) apply(clarsimp simp: modify_map_def const_def) apply(clarsimp split: if_split_asm) apply(drule_tac p="cte_map p" in valid_mdbD1') apply(simp) apply(simp add: valid_mdb'_def valid_mdb_ctes_def) apply(clarsimp simp: nullPointer_def no_0_def) apply(clarsimp simp: state_relation_def) apply(clarsimp simp: cte_wp_at_caps_of_state) apply(drule_tac slot=p in pspace_relation_ctes_ofI) apply(simp add: cte_wp_at_caps_of_state) apply(simp) apply(simp) apply(simp) apply(clarsimp simp: state_relation_def cdt_list_relation_def) apply(erule_tac x="fst p" in allE, erule_tac x="snd p" in allE) apply(fastforce) apply(simp) apply(case_tac "next_slot c (cdt_list s) (cdt s)") apply(simp) apply(simp) apply(subgoal_tac "cte_at c s") prefer 2 apply(rule cte_at_next_slot) apply(simp_all add: valid_mdb_def2)[4] apply(clarsimp simp: modify_map_def const_def) apply(simp split: if_split_asm) apply(simp add: valid_mdb'_def) apply(drule_tac ptr="cte_map p" in no_self_loop_next) apply(simp) apply(simp) apply(drule_tac p="(aa, bb)" in cte_map_inj) apply(simp_all add: cte_wp_at_caps_of_state)[5] apply(clarsimp) apply(simp) apply(clarsimp) apply(drule cte_map_inj_eq; simp add: cte_wp_at_caps_of_state) apply(clarsimp) apply(case_tac z) apply(clarsimp simp: state_relation_def cdt_list_relation_def) apply(erule_tac x=aa in allE, erule_tac x=bb in allE) apply(fastforce) apply(clarsimp) apply(drule cte_map_inj_eq) apply(simp_all add: cte_wp_at_caps_of_state)[6] apply(clarsimp simp: state_relation_def cdt_list_relation_def) apply(erule_tac x=aa in allE, erule_tac x=bb in allE, fastforce) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. cref' = cte_map (fst tup) \<and> cap_relation (default_cap tp (snd tup) sz d) cap \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (fst tup) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) cref' and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (create_cap tp sz p d tup) (insertNewCap (cte_map p) cref' cap) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do x <- getCTE (cte_map p);
oldCTE <- getCTE (cte_map (a, b));
y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba x. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) (getCTE (cte_map (a, b)))
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (getCTE (cte_map p)) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba x. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) (getCTE (cte_map (a, b)))
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (getCTE (cte_map p)) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (getCTE (cte_map p)) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (getCTE (cte_map p)) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True\<rbrakk> \<Longrightarrow> no_fail (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) (getCTE (cte_map p))
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; True; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map p) s
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- assert (cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer);
y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE s x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s; oldCTE = CTE x1 x2\<rbrakk> \<Longrightarrow> cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x s x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; ctes_of s (cte_map (a, b)) = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; no_0 (ctes_of s); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.NullCap n) \<longrightarrow> n = nullMDBNode; ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s)\<rbrakk> \<Longrightarrow> mdbNext x2 = nullPointer \<and> mdbPrev x2 = nullPointer
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x s x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; ctes_of s (cte_map (a, b)) = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; no_0 (ctes_of s); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s); ctes_of s (?p73 a b ba x s x2) = Some (CTE capability.NullCap (?n75 a b ba x s x2)) \<longrightarrow> ?n75 a b ba x s x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbNext x2 = nullPointer \<and> mdbPrev x2 = nullPointer
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x s x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; ctes_of s (cte_map (a, b)) = Some (CTE capability.NullCap x2); valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; no_0 (ctes_of s); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s); x2 = nullMDBNode\<rbrakk> \<Longrightarrow> mdbNext x2 = nullPointer \<and> mdbPrev x2 = nullPointer
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap \<and> mdbNext (cteMDBNode oldCTE) = nullPointer \<and> mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; (s, s') \<in> state_relation; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE s s' da v0 v1 f. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; global.sameRegionAs (capability.UntypedCap da v0 v1 f) cap; cteCap x = capability.UntypedCap da v0 v1 f; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s')\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace> proof (prove)
goal (45 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_mdb114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
A total of 45 subgoals... proof (prove)
goal (45 subgoals):
 1. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_mdb114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt s)\<rbrace>
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
A total of 45 subgoals... proof (prove)
goal (49 subgoals):
 1. \<And>a b ba x oldCTE P dest_p cdta y. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B162 a b ba x oldCTE P dest_p cdta y\<rbrace> create_cap_ext p (a, b) dest_p \<lbrace>\<lambda>ya s. P (cdt (s\<lparr>is_original_cap := (is_original_cap s)((a, b) := True)\<rparr>))\<rbrace>
 2. \<And>a b ba x oldCTE P dest_p cdt. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B161 a b ba x oldCTE P dest_p cdt\<rbrace> set_cdt (cdt((a, b) \<mapsto> p)) \<lbrace>?B162 a b ba x oldCTE P dest_p cdt\<rbrace>
 3. \<And>a b ba x oldCTE P dest_p. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B160 a b ba x oldCTE P dest_p\<rbrace> gets cdt \<lbrace>?B161 a b ba x oldCTE P dest_p\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q159 a b ba x oldCTE P\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?B160 a b ba x oldCTE P\<rbrace>
 5. \<And>a b ba x oldCTE P s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; P (?new_mdb114 a b ba x oldCTE s)\<rbrakk> \<Longrightarrow> ?Q159 a b ba x oldCTE P s
 6. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
A total of 49 subgoals... proof (prove)
goal (49 subgoals):
 1. \<And>a b ba x oldCTE P dest_p cdta y. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B162 a b ba x oldCTE P dest_p cdta y\<rbrace> create_cap_ext p (a, b) dest_p \<lbrace>\<lambda>a b. P (cdt b)\<rbrace>
 2. \<And>a b ba x oldCTE P dest_p cdt. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B161 a b ba x oldCTE P dest_p cdt\<rbrace> set_cdt (cdt((a, b) \<mapsto> p)) \<lbrace>?B162 a b ba x oldCTE P dest_p cdt\<rbrace>
 3. \<And>a b ba x oldCTE P dest_p. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?B160 a b ba x oldCTE P dest_p\<rbrace> gets cdt \<lbrace>?B161 a b ba x oldCTE P dest_p\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q159 a b ba x oldCTE P\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?B160 a b ba x oldCTE P\<rbrace>
 5. \<And>a b ba x oldCTE P s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; P (?new_mdb114 a b ba x oldCTE s)\<rbrakk> \<Longrightarrow> ?Q159 a b ba x oldCTE P s
 6. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
A total of 49 subgoals... proof (prove)
goal (44 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
A total of 44 subgoals... proof (prove)
goal (44 subgoals):
 1. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_caps114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (caps_of_state s)\<rbrace>
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksCurThread s)\<rbrace>
A total of 44 subgoals... proof (prove)
goal (43 subgoals):
 1. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksCurThread s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_as114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (arch_state s)\<rbrace>
A total of 43 subgoals... proof (prove)
goal (43 subgoals):
 1. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_list114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
x <- gets cdt_list;
xa <- get;
x <- put (cdt_list_update (\<lambda>_. case dest_p of None \<Rightarrow> x | Some p \<Rightarrow> x(p := list_remove (x p) (a, b))) xa);
x <- gets cdt_list;
xa <- get;
y <- put (cdt_list_update (\<lambda>_. x(p := (a, b) # x p)) xa);
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cdt_list s)\<rbrace>
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksCurThread s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_as114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (arch_state s)\<rbrace>
A total of 43 subgoals... proof (prove)
goal (42 subgoals):
 1. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_rvk114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (is_original_cap s)\<rbrace>
 2. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ctes114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ctes_of s)\<rbrace>
 3. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (machine_state s)\<rbrace>
 4. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ms'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksMachineState s)\<rbrace>
 5. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (work_units_completed s)\<rbrace>
 6. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_wuc'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksWorkUnitsCompleted s)\<rbrace>
 7. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (cur_thread s)\<rbrace>
 8. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_ct'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksCurThread s)\<rbrace>
 9. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_as114 a b ba x oldCTE s)\<rbrace> do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od \<lbrace>\<lambda>rv s. P (arch_state s)\<rbrace>
 10. \<And>a b ba x oldCTE P. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. P (?new_as'114 a b ba x oldCTE s)\<rbrace> do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od \<lbrace>\<lambda>rv s. P (ksArchState s)\<rbrace>
A total of 42 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; cte_wp_at ((=) cap.NullCap) (a, b) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s' \<and> cte_wp_at' (\<lambda>c. c = x) (cte_map p) s' \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s' \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s' \<and> valid_mdb' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> valid_objs' s' \<and> descendants_range' cap (cte_map p) (ctes_of s'); (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_relation (\<lambda>x. None \<noteq> (if x = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s x)) (\<lambda>c. if c = (a, b) then Some p else cdt s c) (modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb))\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = descendants_of' (cte_map (aa, bb)) (modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) cap
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) cap
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> vmdb (ctes_of s')
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) cap
 6. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) cap
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map p) = Some (CTE (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x))
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) (?parent_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (cteMDBNode x) cap
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) x1 (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> vmdb (ctes_of s')
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) x1 (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_ptr_axioms (ctes_of s') (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) x1 (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map (a, b)) = Some (CTE (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a))
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) x1 (cte_map (a, b)) (?site_cap975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) (?site_node975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a) cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_axioms (ctes_of s') (cte_map p) x1 (cte_map (a, b)) x1a x2a cap (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
A total of 13 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> x1a = capability.NullCap
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdbPrev x2a = 0
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdbNext x2a = 0
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> isUntypedCap x1
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> global.sameRegionAs x1 cap
 6. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> descendants_range' cap (cte_map p) (ctes_of s')
 7. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> capClass cap = PhysicalClass
 8. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a pa capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; ctes_of s' pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> valid_cap' capa (?s975 a b ba x oldCTE s s' aa bb x1 x2 x1a x2a)
 9. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> ut_revocable' (ctes_of s')
 10. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map p \<noteq> cte_map (a, b)
A total of 22 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba s s' aa bb x1 x2 x2a pa capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; mdbNext x2a = 0; mdbPrev x2a = 0; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some (CTE capability.NullCap x2a); valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some (CTE x1 x2); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap x1; global.sameRegionAs x1 cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); ctes_of s' pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> valid_cap' capa (?s975 a b ba (CTE x1 x2) (CTE capability.NullCap x2a) s s' aa bb x1 x2 capability.NullCap x2a)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> ut_revocable' (ctes_of s')
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map p \<noteq> cte_map (a, b)
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> ut_revocable' (ctes_of s')
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map p \<noteq> cte_map (a, b)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map p \<noteq> cte_map (a, b)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdb_insert_again_child_axioms (cte_map p) x1 (cteMDBNode x) cap
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> isMDBParentOf (CTE x1 (cteMDBNode x)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba s s' aa bb x1 x2 x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; mdbNext x2a = nullPointer; mdbPrev x2a = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some (CTE capability.NullCap x2a); valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some (CTE x1 x2); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap x1; global.sameRegionAs x1 cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb))\<rbrakk> \<Longrightarrow> (isNotificationCap x1 \<and> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> (isEndpointCap x1 \<longrightarrow> capEPBadge x1 = 0) \<and> isEndpointCap x1 \<and> capEPBadge x1 \<noteq> 0) \<and> ((isNotificationCap x1 \<longrightarrow> capNtfnBadge x1 = 0) \<longrightarrow> (isEndpointCap x1 \<longrightarrow> capEPBadge x1 = 0) \<and> ((isEndpointCap x1 \<longrightarrow> capEPBadge x1 = 0) \<longrightarrow> mdbRevocable x2))
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba s s' aa bb x2 x2a da v0 v1 f. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; mdbNext x2a = nullPointer; mdbPrev x2a = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some (CTE capability.NullCap x2a); valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some (CTE (capability.UntypedCap da v0 v1 f) x2); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; global.sameRegionAs (capability.UntypedCap da v0 v1 f) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb))\<rbrakk> \<Longrightarrow> mdbRevocable x2
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) (\<lambda>c. if c = (a, b) then Some p else cdt s c) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation (\<lambda>c. if c = p then (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) p else (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> \<lambda>c. if c = p then list_remove (cdt_list s p) (a, b) else cdt_list s c) c) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation (\<lambda>c. if c = (a, b) then True else is_original_cap s c) (null_filter (\<lambda>c. if c = (a, b) then Some (default_cap tp ba sz d) else caps_of_state s c)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` descendants_of (aa, bb) ((cdt s)((a, b) \<mapsto> p)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> descendants_of (a, b) (cdt s) = {}
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> p \<noteq> (a, b)
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cdt s (a, b) = None
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> p \<noteq> (a, b)
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cdt s (a, b) = None
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cdt s (a, b) = None
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 10. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if cte_map p \<in> descendants_of' (cte_map (aa, bb)) (ctes_of s') \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s')
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> valid_mdb s
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> valid_objs s
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> pspace_aligned s
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> pspace_distinct s
 6. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if p \<in> descendants_of (aa, bb) (cdt s) \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> valid_objs s
 3. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> pspace_aligned s
 4. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> pspace_distinct s
 5. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if p \<in> descendants_of (aa, bb) (cdt s) \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if p \<in> descendants_of (aa, bb) (cdt s) \<or> cte_map (aa, bb) = cte_map p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb x1 x2 x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; pspace_aligned s; pspace_distinct s; valid_objs s; ctes_of s' (cte_map (a, b)) = Some oldCTE; valid_mdb s; valid_mdb' s'; ctes_of s' (cte_map p) = Some x; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); None \<noteq> (if aa = a \<and> bb = b then Some (default_cap tp ba sz d) else caps_of_state s (aa, bb)); x = CTE x1 x2; oldCTE = CTE x1a x2a; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_map ` (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of (aa, bb) (cdt s) \<union> {(a, b)} else descendants_of (aa, bb) (cdt s)) = (if p \<in> descendants_of (aa, bb) (cdt s) \<or> (aa, bb) = p then descendants_of' (cte_map (aa, bb)) (ctes_of s') \<union> {cte_map (a, b)} else descendants_of' (cte_map (aa, bb)) (ctes_of s'))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 8. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od) proof (prove)
goal (10 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> sched_act_relation (scheduler_action s) (ksSchedulerAction s')
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ready_queues_relation (ready_queues s) (ksReadyQueues s')
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 7. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s')\<rbrakk> \<Longrightarrow> revokable_relation ((is_original_cap s)((a, b) := True)) (null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d))) (modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (if aa = a \<and> bb = b then True else is_original_cap s (aa, bb)) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa = a \<and> bb = b \<longrightarrow> mdbRevocable node) \<and> ((aa = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node)
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b \<longrightarrow> mdbRevocable node
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (a, b) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> mdbRevocable node
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE s s' y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (a, b) = Some y; cte_map p \<noteq> cte_map (a, b); mdbNext (cteMDBNode x) \<noteq> cte_map (a, b); (if cte_map (a, b) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (cte_map (a, b))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> mdbRevocable node
 2. \<And>a b ba x oldCTE s s' y capa node capaa nodea. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (a, b) = Some y; cte_map p \<noteq> cte_map (a, b); mdbNext (cteMDBNode x) = cte_map (a, b); (if mdbNext (cteMDBNode x) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (mdbNext (cteMDBNode x))) = Some (CTE capaa nodea); CTE capa node = (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea)\<rbrakk> \<Longrightarrow> mdbRevocable node
 3. \<And>a b ba x oldCTE s s' y capa node capaa nodea. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (a, b) = Some y; cte_map p = cte_map (a, b); CTE capa node = (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea); mdbNext (cteMDBNode x) \<noteq> cte_map p; (if cte_map p = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (cte_map p)) = Some (CTE capaa nodea)\<rbrakk> \<Longrightarrow> mdbRevocable node
 4. \<And>a b ba x oldCTE s s' y capa node capaa nodea capb nodeb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (a, b) = Some y; cte_map p = cte_map (a, b); CTE capa node = (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea); mdbNext (cteMDBNode x) = cte_map p; (if mdbNext (cteMDBNode x) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (mdbNext (cteMDBNode x))) = Some (CTE capb nodeb); CTE capaa nodea = (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (CTE capb nodeb)\<rbrakk> \<Longrightarrow> mdbRevocable node
 5. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 9. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (aa = a \<longrightarrow> bb \<noteq> b) \<longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b\<rbrakk> \<Longrightarrow> null_filter (caps_of_state s) (aa, bb) \<noteq> None
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b\<rbrakk> \<Longrightarrow> null_filter (caps_of_state s) (aa, bb) \<noteq> None
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node ya. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) = Some ya\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node ya. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; cte_wp_at (\<lambda>c'. c' = ya \<and> c' \<noteq> cap.NullCap) (aa, bb) s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) s
 2. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 6. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; modify_map (modify_map (\<lambda>c. if c = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' c) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 5. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb y capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map p \<noteq> cte_map (aa, bb); mdbNext (cteMDBNode x) \<noteq> cte_map (aa, bb); (if cte_map (aa, bb) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (cte_map (aa, bb))) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 2. \<And>a b ba x oldCTE s s' aa bb y capa node capaa nodea. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map p \<noteq> cte_map (aa, bb); mdbNext (cteMDBNode x) = cte_map (aa, bb); (if mdbNext (cteMDBNode x) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (mdbNext (cteMDBNode x))) = Some (CTE capaa nodea); CTE capa node = (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea)\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 3. \<And>a b ba x oldCTE s s' aa bb y capa node capaa nodea. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map p = cte_map (aa, bb); CTE capa node = (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea); mdbNext (cteMDBNode x) \<noteq> cte_map p; (if cte_map p = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (cte_map p)) = Some (CTE capaa nodea)\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 4. \<And>a b ba x oldCTE s s' aa bb y capa node capaa nodea capb nodeb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some x; pspace_distinct s; valid_objs s; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; null_filter ((caps_of_state s)((a, b) \<mapsto> default_cap tp ba sz d)) (aa, bb) = Some y; aa = a \<longrightarrow> bb \<noteq> b; null_filter (caps_of_state s) (aa, bb) \<noteq> None; cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map p = cte_map (aa, bb); CTE capa node = (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (CTE capaa nodea); mdbNext (cteMDBNode x) = cte_map p; (if mdbNext (cteMDBNode x) = cte_map (a, b) then Some (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) else ctes_of s' (mdbNext (cteMDBNode x))) = Some (CTE capb nodeb); CTE capaa nodea = (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (CTE capb nodeb)\<rbrakk> \<Longrightarrow> is_original_cap s (aa, bb) = mdbRevocable node
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 8. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
A total of 11 subgoals... proof (prove)
goal (7 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; valid_mdb s; valid_mdb' s'; valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; pspace_aligned' s'; pspace_distinct' s'; valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s')\<rbrakk> \<Longrightarrow> (arch_state s, ksArchState s') \<in> arch_state_relation \<and> interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s') \<and> cur_thread s = ksCurThread s' \<and> idle_thread s = ksIdleThread s' \<and> machine_state s = ksMachineState s' \<and> domain_index s = ksDomScheduleIdx s' \<and> domain_list s = ksDomSchedule s' \<and> cur_domain s = ksCurDomain s' \<and> domain_time s = ksDomainTime s' \<and> work_units_completed s = ksWorkUnitsCompleted s'
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> ups_of_heap (kheap s) = gsUserPages s'
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cns_of_heap (kheap s) = gsCNodes s'
 4. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s)))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s; valid_mdb' s; pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map (a, b)) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>a b ba s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getCTE (cte_map p) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1302 a b ba x oldCTE) (?Q'1302 a b ba x oldCTE) (do dest_p <- gets (\<lambda>s. cdt s (a, b));
cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) dest_p;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 3. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 4. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (5 subgoals):
 1. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1306 a b ba x oldCTE rv) (?Q'1302 a b ba x oldCTE) (do cdt <- gets cdt;
y <- set_cdt (cdt((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) rv;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 3. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 4. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 5. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (6 subgoals):
 1. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1310 a b ba x oldCTE rv rva) (?Q'1302 a b ba x oldCTE) (do y <- set_cdt (rva((a, b) \<mapsto> p));
y <- create_cap_ext p (a, b) rv;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 3. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 4. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 5. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 6. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (7 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1314 a b ba x oldCTE rv rva rvb) (?Q'1302 a b ba x oldCTE) (do y <- create_cap_ext p (a, b) rv;
y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 3. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 4. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 5. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 6. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 7. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (8 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1321 a b ba x oldCTE rv rva rvb rvc) (?Q'1302 a b ba x oldCTE) (do y <- set_original (a, b) True;
set_cap (default_cap tp ba sz d) (a, b)
od) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 3. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 4. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 5. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 6. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 7. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 8. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1328 a b ba x oldCTE rv rva rvb rvc rvd) (?Q'1302 a b ba x oldCTE) (set_cap (default_cap tp ba sz d) (a, b)) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>?Q1328 a b ba x oldCTE rv rva rvb rvc\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 4. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 5. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 6. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 7. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 8. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (10 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')}; ?Q1328 a b ba x oldCTE rv rva rvb rvc rvd s; ?Q'1302 a b ba x oldCTE s'\<rbrakk> \<Longrightarrow> ?f1335 a b ba x oldCTE rv rva rvb rvc rvd s = set_cap (default_cap tp ba sz d) (a, b) s
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1328 a b ba x oldCTE rv rva rvb rvc rvd) (?Q'1302 a b ba x oldCTE) (?f1335 a b ba x oldCTE rv rva rvb rvc rvd) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>?Q1328 a b ba x oldCTE rv rva rvb rvc\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 5. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 6. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 7. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 8. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 9. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 10. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (9 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?Q1328 a b ba x oldCTE rv rva rvb rvc rvd) (?Q'1302 a b ba x oldCTE) (set_cap (default_cap tp ba sz d) (a, b) >>= return) (do y <- setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True));
y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>?Q1328 a b ba x oldCTE rv rva rvb rvc\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 4. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 5. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 6. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 7. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 8. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> ?Q'1302 a b ba x oldCTE s
 9. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (12 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True (?r'1345 a b ba x oldCTE rv rva rvb rvc rvd) (?P1345 a b ba x oldCTE rv rva rvb rvc rvd) (?P'1346 a b ba x oldCTE) (set_cap (default_cap tp ba sz d) (a, b)) (setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)))
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; ?r'1345 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1345 a b ba x oldCTE rv rva rvb rvc rvd rve) (?R'1345 a b ba x oldCTE rv rva rvb rvc rvd rv') (return rve) (do y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>?R1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>?R'1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. ?P1345 a b ba x oldCTE rv rva rvb rvc rvd and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 7. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 8. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 9. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 10. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1345 a b ba x oldCTE rv rva rvb rvc rvd rve) (?R'1345 a b ba x oldCTE rv rva rvb rvc rvd rv') (return rve) (do y <- updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b)));
y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>?R1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>?R'1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 6. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 7. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 8. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
 9. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s\<rbrakk> \<Longrightarrow> ?Q1302 a b ba x oldCTE s
 10. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and ?Q'1347 a b ba x oldCTE) s
A total of 11 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True (?r'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?P1374 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve) (?P'1372 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')) (return rve) (updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))))
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf y. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'; ?r'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf y\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf) (?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' y) (return rvf) (do y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. (?P1370 a b ba x oldCTE rv rva rvb rvc rvd c d and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (?P'1366 a b ba x oldCTE rv rva rvb rvc rvd c d and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 8. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 9. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 10. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?P1374 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?P1370 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?P'1372 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?P'1366 a b ba x oldCTE rv rva rvb rvc rvd
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True (?r'1362 a b ba x oldCTE rv rva () () () () ()) (?P1374 a a b b ba x oldCTE rv rva () () () () () (?ba1360 a b ba x oldCTE rv rva () () () () ()) x (?oldCTE1360 a b ba x oldCTE rv rva () () () () ()) (?rv1360 a b ba x oldCTE rv rva () () () () ()) (?rva1360 a b ba x oldCTE rv rva () () () () ()) () () () ()) (?P'1372 a a b b ba x oldCTE rv rva () () () () () (?ba1360 a b ba x oldCTE rv rva () () () () ()) x (?oldCTE1360 a b ba x oldCTE rv rva () () () () ()) (?rv1360 a b ba x oldCTE rv rva () () () () ()) (?rva1360 a b ba x oldCTE rv rva () () () () ()) () () () ()) (return ()) (updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))))
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf y. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'; ?r'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf y\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf) (?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' y) (return rvf) (do y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. (?P1370 a b ba x oldCTE rv rva rvb rvc rvd c d and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (?P'1366 a b ba x oldCTE rv rva rvb rvc rvd c d and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 8. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 9. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 10. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?P1374 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?P1370 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?P'1372 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?P'1366 a b ba x oldCTE rv rva rvb rvc rvd
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (?ba1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf y. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'; dc rvf y\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' rvf) (?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv' y) (return rvf) (do y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. ((\<lambda>a. True) and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 8. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 9. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 10. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1362 a b ba x oldCTE rv rva () () () () () ()) (?R'1362 a b ba x oldCTE rv rva () () () () () ()) (return ()) (do y <- updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b)));
updateNewFreeIndex (cte_map (a, b))
od)
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>?R1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>?R'1362 a b ba x oldCTE rv rva rvb rvc rvd rve rv'\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. ((\<lambda>a. True) and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 8. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 9. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 10. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (14 subgoals):
 1. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> corres_underlying {(s, s'). pspace_relations (ekheap s) (kheap s) (ksPSpace s')} False True dc (?R1390 a b ba x oldCTE rv rva () () () () () ()) (?R'1384 a b ba x oldCTE rv rva) (return ()) (updateNewFreeIndex (cte_map (a, b)))
 2. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1389 a b ba x oldCTE rv rva () () () () () ()\<rbrace> updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b))) \<lbrace>\<lambda>xa. ?R'1384 a b ba x oldCTE rv rva\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R1390 a b ba x oldCTE rv rva rvb rvc rvd rve rv' c\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>\<lambda>c. pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. cte_map p \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map p) s) and ?Q'1389 a b ba x oldCTE rv rva rvb rvc rvd rve rv' c\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. ((\<lambda>a. True) and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 8. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 9. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 10. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (13 subgoals):
 1. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1389 a b ba x oldCTE rv rva () () () () () ()\<rbrace> updateMDB (cte_map p) (mdbNext_update (\<lambda>_. cte_map (a, b))) \<lbrace>\<lambda>x. cte_wp_at' (\<lambda>_. True) (cte_map (a, b))\<rbrace>
 2. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve\<rbrace> return rve \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; dc rve rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv')\<rbrace> updateMDB (mdbNext (cteMDBNode x)) (mdbPrev_update (\<lambda>_. cte_map (a, b))) \<lbrace>\<lambda>c. pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. cte_map p \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map p) s) and ?Q'1389 a b ba x oldCTE rv rva rvb rvc rvd rve rv' c\<rbrace>
 4. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace> set_cap (default_cap tp ba sz d) (a, b) \<lbrace>\<lambda>c d. ((\<lambda>a. True) and ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 5. \<And>a b ba x oldCTE rv rva rvb rvc rvd. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1347 a b ba x oldCTE\<rbrace> setCTE (cte_map (a, b)) (CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True)) \<lbrace>\<lambda>c d. (pspace_aligned' and pspace_distinct' and no_0 \<circ> ctes_of and (\<lambda>s. mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) and ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd c d) d\<rbrace>
 6. \<And>a b ba x oldCTE rv rva rvb rvc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb rvc\<rbrace> set_original (a, b) True \<lbrace>\<lambda>rvd. pspace_distinct and pspace_aligned and valid_objs and cte_wp_at (\<lambda>_. True) (a, b) and ?Q1345 a b ba x oldCTE rv rva rvb rvc rvd\<rbrace>
 7. \<And>a b ba x oldCTE rv rva rvb. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1314 a b ba x oldCTE rv rva rvb\<rbrace> create_cap_ext p (a, b) rv \<lbrace>?Q1321 a b ba x oldCTE rv rva rvb\<rbrace>
 8. \<And>a b ba x oldCTE rv rva. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1310 a b ba x oldCTE rv rva\<rbrace> set_cdt (rva((a, b) \<mapsto> p)) \<lbrace>?Q1314 a b ba x oldCTE rv rva\<rbrace>
 9. \<And>a b ba x oldCTE rv. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1306 a b ba x oldCTE rv\<rbrace> gets cdt \<lbrace>?Q1310 a b ba x oldCTE rv\<rbrace>
 10. \<And>a b ba x oldCTE. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> \<lbrace>?Q1302 a b ba x oldCTE\<rbrace> gets (\<lambda>s. cdt s (a, b)) \<lbrace>?Q1306 a b ba x oldCTE\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q1373 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') rve \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv'. ?Q1369 a b ba x oldCTE rv rva rvb rvc rvd rve
\<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve rv' c. ?Q'1371 a a b b ba x oldCTE rv rva rvb rvc rvd rve rv' (mdbNext (cteMDBNode x)) x (?oldCTE1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rva1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvb1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvc1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rvd1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') (?rv'1360 a b ba x oldCTE rv rva rvb rvc rvd rve rv') \<equiv>\<^sup>? \<lambda>a b ba x oldCTE rv rva rvb rvc rvd rve. ?Q'1365 a b ba x oldCTE rv rva rvb rvc rvd proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; cte_wp_at ((=) cap.NullCap) (a, b) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> valid_mdb s \<and> valid_list s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p s\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) s
 2. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0 ((ctes_of s)(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) \<and> (mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0 ((ctes_of s)(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) \<and> (cte_map p \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map p) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s)) s
 3. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s\<rbrakk> \<Longrightarrow> (pspace_aligned' and pspace_distinct' and cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) and (\<lambda>s. pspace_aligned' s \<and> pspace_distinct' s \<and> no_0 ((ctes_of s)(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) \<and> (mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (mdbNext (cteMDBNode x)) s) \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0 ((ctes_of s)(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) \<and> (cte_map p \<noteq> 0 \<longrightarrow> cte_wp_at' (\<lambda>_. True) (cte_map p) s) \<and> cte_wp_at' (\<lambda>_. True) (cte_map (a, b)) s)) s
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; ctes_of s (cte_map (a, b)) = Some oldCTE; valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; ctes_of s 0 = None; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s)\<rbrakk> \<Longrightarrow> cte_map (a, b) \<noteq> 0 \<and> (cte_map (a, b) \<noteq> 0 \<longrightarrow> mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode x)) = Some cte))
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; ctes_of s (cte_map (a, b)) = Some oldCTE; valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; ctes_of s 0 = None; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s)\<rbrakk> \<Longrightarrow> cte_map (a, b) \<noteq> 0 \<longrightarrow> mdbNext (cteMDBNode x) \<noteq> 0 \<longrightarrow> (\<exists>cte. ctes_of s (mdbNext (cteMDBNode x)) = Some cte)
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; ctes_of s (cte_map (a, b)) = Some oldCTE; valid_dlist (ctes_of s); ctes_of s (cte_map p) = Some x; ctes_of s 0 = None; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s); cte_map (a, b) \<noteq> 0; mdbNext (cteMDBNode x) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode x)) = Some cte
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s cte'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; ctes_of s (cte_map (a, b)) = Some oldCTE; ctes_of s (cte_map p) = Some x; ctes_of s 0 = None; isUntypedCap (cteCap x); global.sameRegionAs (cteCap x) cap; mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pspace_aligned' s; pspace_distinct' s; valid_objs' s; descendants_range' cap (cte_map p) (ctes_of s); cte_map (a, b) \<noteq> 0; mdbNext (cteMDBNode x) \<noteq> 0; ctes_of s (mdbNext (cteMDBNode x)) = Some cte'; mdbPrev (cteMDBNode cte') = cte_map p\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s (mdbNext (cteMDBNode x)) = Some cte
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and valid_mdb and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> cdt_list_relation ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) (modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b))))) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> \<forall>c capa node. modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node) \<longrightarrow> (case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s)\<rbrakk> \<Longrightarrow> \<forall>c capa node. modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node) \<longrightarrow> (case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> finite_depth (cdt s) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation\<rbrakk> \<Longrightarrow> finite_depth (cdt s)
 2. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s)\<rbrakk> \<Longrightarrow> \<forall>c capa node. modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node) \<longrightarrow> (case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s'. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s)\<rbrakk> \<Longrightarrow> \<forall>c capa node. modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node) \<longrightarrow> (case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next) proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt s) p (a, b) proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt s) p (a, b)
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt s) p (a, b)
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> p \<noteq> (a, b)
 2. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> cdt s (a, b) = None
 3. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> descendants_of (a, b) (cdt s) = {}
 4. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> cdt s (a, b) = None
 2. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> descendants_of (a, b) (cdt s) = {}
 3. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' aa bb capa node capaa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (aa, bb)) = Some (CTE capa node); caps_of_state s (a, b) = Some cap.NullCap; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; caps_of_state s p = Some capaa; cap.NullCap \<noteq> capaa\<rbrakk> \<Longrightarrow> descendants_of (a, b) (cdt s) = {}
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s')\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> no_0 (ctes_of s') proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b)\<rbrakk> \<Longrightarrow> no_0 (ctes_of s')
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s')\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (cte_wp_at ((=) cap.NullCap) (a, b) and pspace_aligned and pspace_distinct and valid_objs and (\<lambda>s. mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_list and cte_wp_at ((\<noteq>) cap.NullCap) p) s; (cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) and (cte_wp_at' (\<lambda>c. c = x) (cte_map p) and (cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) and cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) and valid_mdb' and pspace_aligned' and pspace_distinct' and valid_objs' and (\<lambda>s. descendants_range' cap (cte_map p) (ctes_of s))))) s'; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s')\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; cte_wp_at ((=) cap.NullCap) (a, b) s \<and> pspace_aligned s \<and> pspace_distinct s \<and> valid_objs s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_list s \<and> cte_wp_at ((\<noteq>) cap.NullCap) p s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s' \<and> cte_wp_at' (\<lambda>c. c = x) (cte_map p) s' \<and> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s' \<and> cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s' \<and> valid_mdb' s' \<and> pspace_aligned' s' \<and> pspace_distinct' s' \<and> valid_objs' s' \<and> descendants_range' cap (cte_map p) (ctes_of s'); (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s')\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = Some aa\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> case next_slot c ((case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b)))(p := (a, b) # (case cdt s (a, b) of None \<Rightarrow> cdt_list s | Some p \<Rightarrow> (cdt_list s)(p := list_remove (cdt_list s p) (a, b))) p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None\<rbrakk> \<Longrightarrow> case next_slot c ((cdt_list s)(p := (a, b) # cdt_list s p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext (cteMDBNode x)) (cte_map p) True True))) (mdbNext (cteMDBNode x)) (if mdbNext (cteMDBNode x) = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; cte_wp_at' (\<lambda>c. c = oldCTE) (cte_map (a, b)) s'; pspace_aligned s; cte_wp_at' (\<lambda>c. c = x) (cte_map p) s'; pspace_distinct s; cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) (cte_map (a, b)) s'; valid_objs s; cte_wp_at' (\<lambda>cte. isUntypedCap (cteCap cte) \<and> global.sameRegionAs (cteCap cte) cap) (cte_map p) s'; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2\<rbrakk> \<Longrightarrow> case next_slot c ((cdt_list s)(p := (a, b) # cdt_list s p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2\<rbrakk> \<Longrightarrow> case next_slot c ((cdt_list s)(p := (a, b) # cdt_list s p)) ((cdt s)((a, b) \<mapsto> p)) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c = p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map p) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c = p\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (a, b)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 z. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdb_insert_abs (cdt s) (aa, bb) (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map (aa, bb)) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map (aa, bb)) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) (aa, bb) s; cdt s (a, b) = None; p = (aa, bb); isUntypedCap x1; global.sameRegionAs x1 cap; (if cte_map (aa, bb) = mdbNext x2 then map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map (aa, bb)) True True)) else ctes_of s' (mdbNext x2)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map (aa, bb)) True True))) (cte_map (aa, bb))) = Some z; (if cte_map (aa, bb) = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) z = CTE capa node\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (a, b)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 z x1a x2a. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdb_insert_abs (cdt s) (aa, bb) (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map (aa, bb)) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map (aa, bb)) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) (aa, bb) s; cdt s (a, b) = None; p = (aa, bb); isUntypedCap x1; global.sameRegionAs x1 cap; (if cte_map (aa, bb) = mdbNext x2 then map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map (aa, bb)) True True)) else ctes_of s' (mdbNext x2)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map (aa, bb)) True True))) (cte_map (aa, bb))) = Some z; (if cte_map (aa, bb) = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) z = CTE capa node; z = CTE x1a x2a\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (a, b)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c = (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; (a, b) \<noteq> p; c = (a, b)\<rbrakk> \<Longrightarrow> case next_slot p (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; (a, b) \<noteq> p; c = (a, b); next_slot p (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> case next_slot p (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; (a, b) \<noteq> p; c = (a, b); next_slot p (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot p (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; (a, b) \<noteq> p; c = (a, b); next_slot p (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot p (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map (a, b)) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; (a, b) \<noteq> p; c = (a, b); next_slot p (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' capa node x1 x2 ab bc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); (if cte_map (a, b) = cte_map p then map_option (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (if cte_map p = mdbNext x2 then map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map p) True True)) else ctes_of s' (mdbNext x2)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (cte_map p)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True), mdbNext x2 := map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map p) True True)) else ctes_of s' (mdbNext x2)))) (cte_map (a, b))) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap\<rbrakk> \<Longrightarrow> mdbNext node = cte_map (ab, bc)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (5 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE x1 x2)) \<noteq> 0
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0\<rbrakk> \<Longrightarrow> valid_mdb' s'
 3. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; \<exists>c. ctes_of s' (mdbNext (cteMDBNode (CTE x1 x2))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map p\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 4. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 5. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0\<rbrakk> \<Longrightarrow> valid_mdb' s'
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; \<exists>c. ctes_of s' (mdbNext (cteMDBNode (CTE x1 x2))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map p\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 4. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; \<exists>c. ctes_of s' (mdbNext (cteMDBNode (CTE x1 x2))) = Some c \<and> mdbPrev (cteMDBNode c) = cte_map p\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (6 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (?c1822 a b ba oldCTE s s' x1 x2 ab bc capa)) p s
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 3. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 4. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa; \<exists>cte. ctes_of s' (cte_map p) = Some cte \<and> cap_relation (?c1822 a b ba oldCTE s s' x1 x2 ab bc capa) (cteCap cte)\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 5. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 6. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (5 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> pspace_aligned' s'
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 3. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa; \<exists>cte. ctes_of s' (cte_map p) = Some cte \<and> cap_relation capa (cteCap cte)\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 4. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 5. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (4 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa\<rbrakk> \<Longrightarrow> pspace_distinct' s'
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa; \<exists>cte. ctes_of s' (cte_map p) = Some cte \<and> cap_relation capa (cteCap cte)\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 4. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc capa. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); ctes_of s' 0 = None; caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (mdbNext x2) = Some oldCTE; pspace_aligned s; pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap 0 (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = mdbNext x2; cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = 0; mdbPrev (cteMDBNode oldCTE) = 0; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = 0; ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); cdt_list_relation (cdt_list s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; caps_of_state s p = Some capa; cap.NullCap \<noteq> capa; \<exists>cte. ctes_of s' (cte_map p) = Some cte \<and> cap_relation capa (cteCap cte)\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (a, b) \<noteq> p; next_slot p (cdt_list s) (cdt s) = Some (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; \<forall>cap node. ctes_of s' (cte_map (fst p, snd p)) = Some (CTE cap node) \<longrightarrow> (case next_slot (fst p, snd p) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> mdbNext x2 = cte_map (ab, bc)
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case if c = p then Some (a, b) else if c = (a, b) then next_slot p (cdt_list s) (cdt s) else next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b)\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = None\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> case next_slot c (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>_. True) c s\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) c s proof (prove)
goal (2 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) c s
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>_. True) c s\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (5 subgoals):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> valid_list s
 2. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> valid_mdb s
 3. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> finite_depth (cdt s)
 4. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa\<rbrakk> \<Longrightarrow> next_slot c (cdt_list s) (cdt s) = Some (?n1850 a b ba x oldCTE s s' c capa node x1 x2 aa)
 5. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>_. True) c s\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (1 subgoal):
 1. \<And>a b ba x oldCTE s s' c capa node x1 x2 aa. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); modify_map (modify_map ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (mdbNext x2) (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))))) (cte_map p) (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (cte_map c) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; isUntypedCap x1 \<and> global.sameRegionAs x1 cap; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; x = CTE x1 x2; c \<noteq> p; c \<noteq> (a, b); next_slot c (cdt_list s) (cdt s) = Some aa; cte_wp_at (\<lambda>_. True) c s\<rbrakk> \<Longrightarrow> mdbNext node = cte_map aa proof (prove)
goal (1 subgoal):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); (if cte_map (aa, bb) = cte_map p then map_option (if cte_map p = 0 then id else cteMDBNode_update (mdbNext_update (\<lambda>_. cte_map (a, b)))) (if cte_map p = mdbNext x2 then map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map p) True True)) else ctes_of s' (mdbNext x2)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True))) (cte_map p)) else ((ctes_of s')(cte_map (a, b) \<mapsto> CTE cap (MDB (mdbNext x2) (cte_map p) True True), mdbNext x2 := map_option (if mdbNext x2 = 0 then id else cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b)))) (if mdbNext x2 = cte_map (a, b) then Some (CTE cap (MDB (mdbNext x2) (cte_map p) True True)) else ctes_of s' (mdbNext x2)))) (cte_map (aa, bb))) = Some (CTE capa node); mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (6 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (mdbNext x2) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (mdbNext x2) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = mdbNext x2; mdbNext x2 \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) (mdbPrev_update (\<lambda>_. cte_map (a, b)) x2) = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 6. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (6 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (mdbNext x2) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb_ctes (ctes_of s'); untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (mdbNext x2) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = mdbNext x2; mdbNext x2 \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) (mdbPrev_update (\<lambda>_. cte_map (a, b)) x2) = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 6. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (7 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (mdbNext x2) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (mdbNext x2) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = mdbNext x2; mdbNext x2 \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) (mdbPrev_update (\<lambda>_. cte_map (a, b)) x2) = node\<rbrakk> \<Longrightarrow> ctes_of s' (cte_map p) = Some (?cte1972 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (mdbNext x2) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (mdbNext x2) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = mdbNext x2; mdbNext x2 \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) (mdbPrev_update (\<lambda>_. cte_map (a, b)) x2) = node; mdbNext (cteMDBNode (?cte1972 a b ba oldCTE s s' aa bb capa node x2 ab bc)) \<noteq> cte_map p\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 6. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 7. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (6 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (mdbNext x2) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (mdbNext x2) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; cte_map p = mdbNext x2; mdbNext x2 \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) (mdbPrev_update (\<lambda>_. cte_map (a, b)) x2) = node; mdbNext (cteMDBNode (CTE capa x2)) \<noteq> cte_map p\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 6. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (5 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (10 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s1975 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) p (?s1975 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 3. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> valid_objs (?s1975 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 4. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> pspace_aligned (?s1975 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 5. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> pspace_distinct (?s1975 a b ba oldCTE s s' aa bb capa node x2 ab bc)
 6. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node; cte_map (aa, bb) \<noteq> cte_map p\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 7. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 8. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 9. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 10. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (6 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); caps_of_state s (a, b) = Some cap.NullCap; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; \<exists>cap. caps_of_state s p = Some cap \<and> cap.NullCap \<noteq> cap; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); \<exists>cap. caps_of_state s (aa, bb) = Some cap; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node\<rbrakk> \<Longrightarrow> \<exists>cap. caps_of_state s p = Some cap
 2. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node; cte_map (aa, bb) \<noteq> cte_map p\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 6. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (5 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE capa x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap capa; global.sameRegionAs capa cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) = cte_map p; cte_map p \<noteq> 0; cte_map p \<noteq> mdbNext x2; cte_map p \<noteq> cte_map (a, b); mdbNext_update (\<lambda>_. cte_map (a, b)) x2 = node; cte_map (aa, bb) \<noteq> cte_map p\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 5. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (4 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (4 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; cte_map (a, b) \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (aa, bb) = cte_map (a, b); cte_map (a, b) \<noteq> 0; mdbNext x2 = cte_map (a, b)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 4. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); \<exists>z. ctes_of s' (mdbNext x2) = Some z \<and> cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc z. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); ctes_of s' (mdbNext x2) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc z x1a x2a. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); ctes_of s' (mdbNext x2) = Some z; cteMDBNode_update (mdbPrev_update (\<lambda>_. cte_map (a, b))) z = CTE capa node; z = CTE x1a x2a\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc x2a. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2a \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); ctes_of s' (mdbNext x2) = Some (CTE capa x2a); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (3 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc x2a. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2a \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; finite_depth (cdt s); mdbNext x2 \<noteq> cte_map p; cte_map (aa, bb) = mdbNext x2; mdbNext x2 \<noteq> 0; mdbNext x2 \<noteq> cte_map (a, b); ctes_of s' (mdbNext x2) = Some (CTE capa x2a); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'; \<forall>cap node. ctes_of s' (cte_map (aa, bb)) = Some (CTE cap node) \<longrightarrow> (case next_slot (aa, bb) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 3. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb capa x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' capa (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 capa; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) capa; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass capa = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b); cap = capa\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (2 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; cte_map (aa, bb) = cte_map (a, b)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 2. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (7 subgoals):
 1. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (aa, bb) (?s2043 a b ba oldCTE s s' aa bb x1 x2 ab bc)
 2. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) (a, b) (?s2043 a b ba oldCTE s s' aa bb x1 x2 ab bc)
 3. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> valid_objs (?s2043 a b ba oldCTE s s' aa bb x1 x2 ab bc)
 4. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> pspace_aligned (?s2043 a b ba oldCTE s s' aa bb x1 x2 ab bc)
 5. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2\<rbrakk> \<Longrightarrow> pspace_distinct (?s2043 a b ba oldCTE s s' aa bb x1 x2 ab bc)
 6. \<And>a b ba oldCTE s s' aa bb x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext x2 \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (a, b) \<noteq> cte_map p; cte_map (a, b) \<noteq> mdbNext x2; (aa, bb) = (a, b)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b
 7. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (1 subgoal):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; (s, s') \<in> state_relation; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node)\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal (1 subgoal):
 1. \<And>a b ba oldCTE s s' aa bb capa node x1 x2 ab bc. \<lbrakk>mdb_insert_abs (cdt s) p (a, b); no_0 (ctes_of s'); cte_wp_at ((=) cap.NullCap) (a, b) s; ctes_of s' (cte_map (a, b)) = Some oldCTE; pspace_aligned s; ctes_of s' (cte_map p) = Some (CTE x1 x2); pspace_distinct s; valid_objs s; mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> cap.NullCap \<noteq> c) (cdt s); valid_mdb' s'; untyped_mdb (cdt s) (caps_of_state s); pspace_aligned' s'; descendants_inc (cdt s) (caps_of_state s); pspace_distinct' s'; no_mloop (cdt s); valid_objs' s'; descendants_range' cap (cte_map p) (ctes_of s'); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_list s; cte_wp_at ((\<noteq>) cap.NullCap) p s; cdt s (a, b) = None; (aa, bb) \<noteq> p; next_slot (aa, bb) (cdt_list s) (cdt s) = Some (ab, bc); cte_wp_at (\<lambda>_. True) (aa, bb) s; mdbNext node \<noteq> cte_map (ab, bc); isUntypedCap x1; global.sameRegionAs x1 cap; tup = ((a, b), ba); cref' = cte_map (a, b); cap_relation (default_cap tp ba sz d) cap; cteCap oldCTE = capability.NullCap; mdbNext (cteMDBNode oldCTE) = nullPointer; mdbPrev (cteMDBNode oldCTE) = nullPointer; capClass cap = PhysicalClass; finite_depth (cdt s); cte_map (aa, bb) \<noteq> cte_map p; cte_map (aa, bb) \<noteq> mdbNext x2; cte_map (aa, bb) \<noteq> cte_map (a, b); ctes_of s' (cte_map (aa, bb)) = Some (CTE capa node); pspace_relation (kheap s) (ksPSpace s'); ekheap_relation (ekheap s) (ksPSpace s'); sched_act_relation (scheduler_action s) (ksSchedulerAction s'); ready_queues_relation (ready_queues s) (ksReadyQueues s'); ghost_relation (kheap s) (gsUserPages s') (gsCNodes s'); cdt_relation (swp (cte_wp_at (\<lambda>_. True)) s) (cdt s) (ctes_of s'); \<forall>a b cap node. ctes_of s' (cte_map (a, b)) = Some (CTE cap node) \<longrightarrow> (case next_slot (a, b) (cdt_list s) (cdt s) of None \<Rightarrow> True | Some next \<Rightarrow> mdbNext node = cte_map next); revokable_relation (is_original_cap s) (null_filter (caps_of_state s)) (ctes_of s'); (arch_state s, ksArchState s') \<in> arch_state_relation; interrupt_state_relation (interrupt_irq_node s) (interrupt_states s) (ksInterruptState s'); cur_thread s = ksCurThread s'; idle_thread s = ksIdleThread s'; machine_state s = ksMachineState s'; work_units_completed s = ksWorkUnitsCompleted s'; domain_index s = ksDomScheduleIdx s'; domain_list s = ksDomSchedule s'; cur_domain s = ksCurDomain s'; domain_time s = ksDomainTime s'\<rbrakk> \<Longrightarrow> aa = a \<and> bb = b proof (prove)
goal:
No subgoals!