theory ArchFinalise_AI

lemma (* empty_slot_invs *) [Finalise_AI_asms]:
  "\<lbrace>\<lambda>s. invs s \<and> cte_wp_at (replaceable s sl cap.NullCap) sl s \<and>
        emptyable sl s \<and>
        (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s) (sl \<mapsto> NullCap)))\<rbrace>
     empty_slot sl info
   \<lbrace>\<lambda>rv. invs\<rbrace>" apply (simp add: empty_slot_def set_cdt_def bind_assoc cong: if_cong) apply (wp post_cap_deletion_invs) apply (simp add: invs_def valid_state_def valid_mdb_def2) apply (wp replace_cap_valid_pspace set_cap_caps_of_state2
                  replace_cap_ifunsafe get_cap_wp
                  set_cap_idle valid_irq_node_typ set_cap_typ_at
                  set_cap_irq_handlers set_cap_valid_arch_caps
                  set_cap_cap_refs_respects_device_region_NullCap
                  | simp add: trans_state_update[symmetric] del: trans_state_update fun_upd_apply split del: if_split )+ apply (clarsimp simp: is_final_cap'_def2 simp del: fun_upd_apply) apply (clarsimp simp: conj_comms invs_def valid_state_def valid_mdb_def2) apply (subgoal_tac "mdb_empty_abs s") prefer 2 apply (rule mdb_empty_abs.intro) apply (rule vmdb_abs.intro) apply (simp add: valid_mdb_def swp_def cte_wp_at_caps_of_state conj_comms) apply (clarsimp simp: untyped_mdb_def mdb_empty_abs.descendants mdb_empty_abs.no_mloop_n
                        valid_pspace_def cap_range_def) apply (clarsimp simp: untyped_inc_def mdb_empty_abs.descendants mdb_empty_abs.no_mloop_n) apply (simp add: ut_revocable_def cur_tcb_def valid_irq_node_def
                   no_cap_to_obj_with_diff_ref_Null) apply (rule conjI) apply (clarsimp simp: cte_wp_at_cte_at) apply (rule conjI) apply (clarsimp simp: irq_revocable_def) apply (rule conjI) apply (clarsimp simp: reply_master_revocable_def) apply (thin_tac "info \<noteq> NullCap \<longrightarrow> P info" for P) apply (rule conjI) apply (clarsimp simp: valid_machine_state_def) apply (rule conjI) apply (clarsimp simp:descendants_inc_def mdb_empty_abs.descendants) apply (rule conjI) apply (clarsimp simp: reply_mdb_def) apply (rule conjI) apply (unfold reply_caps_mdb_def)[1] apply (rule allEI, assumption) apply (fold reply_caps_mdb_def)[1] apply (case_tac "sl = ptr", simp) apply (simp add: fun_upd_def split del: if_split del: split_paired_Ex) apply (erule allEI, rule impI, erule(1) impE) apply (erule exEI) apply (simp, rule ccontr) apply (erule(5) emptyable_no_reply_cap) apply simp apply (unfold reply_masters_mdb_def)[1] apply (elim allEI) apply (clarsimp simp: mdb_empty_abs.descendants) apply (rule conjI) apply (simp add: valid_ioc_def) apply (rule conjI) apply (clarsimp simp: tcb_cap_valid_def
                  dest!: emptyable_valid_NullCapD) apply (rule conjI) apply (clarsimp simp: mdb_cte_at_def cte_wp_at_caps_of_state) apply (cases sl) apply (rule conjI, clarsimp) apply (subgoal_tac "cdt s \<Turnstile> (ab,bb) \<rightarrow> (ab,bb)") apply (simp add: no_mloop_def) apply (rule r_into_trancl) apply (simp add: cdt_parent_of_def) apply fastforce apply (clarsimp simp: cte_wp_at_caps_of_state replaceable_def
                        vs_cap_ref_simps table_cap_ref_simps
                   del: allI) apply (case_tac "is_final_cap' cap s") apply auto[1] apply (simp add: is_final_cap'_def2 cte_wp_at_caps_of_state) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. invs s \<and> cte_wp_at (replaceable s sl NullCap) sl s \<and> emptyable sl s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)))\<rbrace> empty_slot sl info \<lbrace>\<lambda>rv. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. invs s \<and> cte_wp_at (replaceable s sl NullCap) sl s \<and> emptyable sl s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)))\<rbrace> do cap <- get_cap sl;
if cap = NullCap then return () else do slot_p <- gets (\<lambda>s. cdt s sl);
cdt <- gets cdt;
x <- get;
y <- put (x\<lparr>cdt := (\<lambda>p. if cdt p = Some sl then cdt sl else cdt p)(sl := None)\<rparr>);
y <- do_extended_op (empty_slot_ext sl slot_p);
y <- set_original sl False;
y <- set_cap NullCap sl;
post_cap_deletion info
od
od \<lbrace>\<lambda>rv. invs\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_p cdt x y ya yb. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B13 cap slot_p cdt x y ya yb\<rbrace> set_cap NullCap sl \<lbrace>\<lambda>yc s. invs s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info (caps_of_state s))\<rbrace>
 2. \<And>cap slot_p cdt x y ya. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B12 cap slot_p cdt x y ya\<rbrace> set_original sl False \<lbrace>?B13 cap slot_p cdt x y ya\<rbrace>
 3. \<And>cap slot_p cdt x y. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B11 cap slot_p cdt x y\<rbrace> do_extended_op (empty_slot_ext sl slot_p) \<lbrace>?B12 cap slot_p cdt x y\<rbrace>
 4. \<And>cap slot_p cdt x. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B10 cap slot_p cdt x\<rbrace> put (x\<lparr>cdt := (\<lambda>p. if cdt p = Some sl then cdt sl else cdt p)(sl := None)\<rparr>) \<lbrace>?B11 cap slot_p cdt x\<rbrace>
 5. \<And>cap slot_p cdt. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B9 cap slot_p cdt\<rbrace> get \<lbrace>?B10 cap slot_p cdt\<rbrace>
 6. \<And>cap slot_p. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B8 cap slot_p\<rbrace> gets cdt \<lbrace>?B9 cap slot_p\<rbrace>
 7. \<And>cap. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?R6 cap\<rbrace> gets (\<lambda>s. cdt s sl) \<lbrace>?B8 cap\<rbrace>
 8. \<lbrace>?Q4\<rbrace> get_cap sl \<lbrace>\<lambda>cap s. (cap = NullCap \<longrightarrow> invs s) \<and> (cap \<noteq> NullCap \<longrightarrow> ?R6 cap s)\<rbrace>
 9. \<And>s. invs s \<and> cte_wp_at (replaceable s sl NullCap) sl s \<and> emptyable sl s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap))) \<Longrightarrow> ?Q4 s proof (prove)
goal (9 subgoals):
 1. \<And>cap slot_p cdta x. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B13 cap slot_p cdta x () () ()\<rbrace> set_cap NullCap sl \<lbrace>\<lambda>yc s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info (caps_of_state s))\<rbrace>
 2. \<And>cap slot_p cdt x y ya. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B12 cap slot_p cdt x y ya\<rbrace> set_original sl False \<lbrace>?B13 cap slot_p cdt x y ya\<rbrace>
 3. \<And>cap slot_p cdt x y. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B11 cap slot_p cdt x y\<rbrace> do_extended_op (empty_slot_ext sl slot_p) \<lbrace>?B12 cap slot_p cdt x y\<rbrace>
 4. \<And>cap slot_p cdt x. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B10 cap slot_p cdt x\<rbrace> put (x\<lparr>cdt := (\<lambda>p. if cdt p = Some sl then cdt sl else cdt p)(sl := None)\<rparr>) \<lbrace>?B11 cap slot_p cdt x\<rbrace>
 5. \<And>cap slot_p cdt. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B9 cap slot_p cdt\<rbrace> get \<lbrace>?B10 cap slot_p cdt\<rbrace>
 6. \<And>cap slot_p. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?B8 cap slot_p\<rbrace> gets cdt \<lbrace>?B9 cap slot_p\<rbrace>
 7. \<And>cap. cap \<noteq> NullCap \<Longrightarrow> \<lbrace>?R6 cap\<rbrace> gets (\<lambda>s. cdt s sl) \<lbrace>?B8 cap\<rbrace>
 8. \<lbrace>?Q4\<rbrace> get_cap sl \<lbrace>\<lambda>cap s. (cap = NullCap \<longrightarrow> invs s) \<and> (cap \<noteq> NullCap \<longrightarrow> ?R6 cap s)\<rbrace>
 9. \<And>s. invs s \<and> cte_wp_at (replaceable s sl NullCap) sl s \<and> emptyable sl s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap))) \<Longrightarrow> ?Q4 s proof (prove)
goal (1 subgoal):
 1. \<And>s. invs s \<and> cte_wp_at (replaceable s sl NullCap) sl s \<and> emptyable sl s \<and> (info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap))) \<Longrightarrow> \<forall>cap. cte_wp_at ((=) cap) sl s \<longrightarrow> cap \<noteq> NullCap \<longrightarrow> valid_pspace s \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. \<exists>c. ((caps_of_state s)(sl \<mapsto> NullCap)) p = Some c \<and> NullCap \<noteq> c) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> \<not> ((is_original_cap s)(sl := False)) sl \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_objs s \<and> zombies_final s \<and> valid_reply_caps s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> valid_global_refs s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> cte_wp_at (\<lambda>cap'. True) sl s \<and> valid_irq_states s \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> vs_cap_ref NullCap = Some vref \<and> {} = obj_refs cap' \<or> \<not> is_final_cap' cap' (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> \<not> reachable_pg_cap cap' s \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>invs s; cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap\<rbrakk> \<Longrightarrow> valid_pspace s \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. \<exists>c. ((caps_of_state s)(sl \<mapsto> NullCap)) p = Some c \<and> NullCap \<noteq> c) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> \<not> ((is_original_cap s)(sl := False)) sl \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_objs s \<and> zombies_final s \<and> valid_reply_caps s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> valid_reply_masters s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> valid_global_refs s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> cte_wp_at (\<lambda>cap'. True) sl s \<and> valid_irq_states s \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> vs_cap_ref NullCap = Some vref \<and> {} = obj_refs cap' \<or> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<and> \<not> reachable_pg_cap cap' s \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s)\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s)\<rbrakk> \<Longrightarrow> mdb_empty_abs s proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s)\<rbrakk> \<Longrightarrow> mdb_empty_abs s
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s)\<rbrakk> \<Longrightarrow> vmdb_abs s
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s)\<rbrakk> \<Longrightarrow> valid_mdb s
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_pspace s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); untyped_mdb (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s\<rbrakk> \<Longrightarrow> valid_objs s \<and> zombies_final s \<and> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> global_refs s \<inter> cap_range NullCap = {} \<and> (\<forall>ref\<in>cap_range NullCap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> no_mloop ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); untyped_inc (cdt s) (caps_of_state s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> untyped_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; cur_tcb s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_node s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); ut_revocable (is_original_cap s) (caps_of_state s); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> ut_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) sl s \<and> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> cte_wp_at (\<lambda>_. True) sl s
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(sl := False)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; info \<noteq> NullCap \<longrightarrow> post_cap_delete_pre info ((caps_of_state s)(sl \<mapsto> NullCap)); cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>) \<and> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_machine_state (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)\<rparr>)
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> descendants_inc ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> reply_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_caps_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap)) \<and> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_caps_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; \<forall>ptr t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights')); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> \<forall>ptr t rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = Some ptr' \<and> ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; \<forall>ptr t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights')); reply_masters_mdb (cdt s) (caps_of_state s); \<forall>t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<forall>t rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = Some ptr' \<and> ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); \<forall>t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<forall>t rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = Some ptr' \<and> ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); \<forall>t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights')); sl \<noteq> ptr\<rbrakk> \<Longrightarrow> \<forall>t rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = Some ptr' \<and> ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); \<forall>t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))); sl \<noteq> ptr\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. (if cdt s ptr = Some sl then cdt s sl else cdt s ptr) = Some ptr' \<and> (\<exists>rights'. (if ptr' = sl then Some NullCap else caps_of_state s ptr') = Some (ReplyCap t True rights')))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr t. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); sl \<noteq> ptr; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); \<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<exists>ptr'. (if cdt s ptr = Some sl then cdt s sl else cdt s ptr) = Some ptr' \<and> (\<exists>rights'. (if ptr' = sl then Some NullCap else caps_of_state s ptr') = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr t x. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); sl \<noteq> ptr; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some x \<and> (\<exists>rights'. caps_of_state s x = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> (if cdt s ptr = Some sl then cdt s sl else cdt s ptr) = Some x \<and> (\<exists>rights'. (if x = sl then Some NullCap else caps_of_state s x) = Some (ReplyCap t True rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr t x. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); sl \<noteq> ptr; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some x \<and> (\<exists>rights'. caps_of_state s x = Some (ReplyCap t True rights')); \<not> x \<noteq> sl\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (3 subgoals):
 1. \<And>s cap ptr t x. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); sl \<noteq> ptr; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some x \<and> (\<exists>rights'. caps_of_state s x = Some (ReplyCap t True rights')); \<not> x \<noteq> sl\<rbrakk> \<Longrightarrow> cdt s ptr = Some sl
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s)\<rbrakk> \<Longrightarrow> reply_masters_mdb ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ((caps_of_state s)(sl \<mapsto> NullCap))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); \<forall>ptr t rights. caps_of_state s ptr = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> \<forall>ptr t rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t True rights) \<longrightarrow> ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)). \<exists>rights'. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t False rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap ptr t. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; reply_caps_mdb (cdt s) (caps_of_state s); \<forall>t rights. caps_of_state s ptr = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); \<forall>b a ba c. caps_of_state s (t, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (a, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (t, b) \<in> descendants_of (a, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (a, ba) \<in> descendants_of (t, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (a, ba) \<in> descendants_of (t, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (t, b) \<in> descendants_of (a, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> t = a \<and> b = ba))\<rbrakk> \<Longrightarrow> \<forall>rights. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr = Some (ReplyCap t True rights) \<longrightarrow> ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)). \<exists>rights'. ((caps_of_state s)(sl \<mapsto> NullCap)) ptr' = Some (ReplyCap t False rights'))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> valid_ioc (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>)
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>) \<and> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> tcb_cap_valid NullCap sl (s\<lparr>cdt := (\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None), is_original_cap := (is_original_cap s)(sl := False)\<rparr>)
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None)) \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. p \<noteq> sl \<and> (p \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c))) ((\<lambda>p. if cdt s p = Some sl then cdt s sl else cdt s p)(sl := None))
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (2 subgoals):
 1. \<And>s cap a b aa ba. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s\<rbrakk> \<Longrightarrow> (cdt s (aa, ba) = Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s sl = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl \<and> ((a, b) \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c)) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c)) \<and> (cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl)
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (2 subgoals):
 1. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> (cdt s (aa, ba) = Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s sl = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl \<and> ((a, b) \<noteq> sl \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c)) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c)) \<and> (cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl)
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (3 subgoals):
 1. \<And>s cap aa ba ab bb. \<lbrakk>replaceable s (ab, bb) NullCap cap; emptyable (ab, bb) s; caps_of_state s (ab, bb) = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb); cdt s (aa, ba) = Some (ab, bb); aa = ab \<longrightarrow> ba \<noteq> bb; cdt s (ab, bb) = Some (ab, bb)\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (4 subgoals):
 1. \<And>s cap aa ba ab bb. \<lbrakk>replaceable s (ab, bb) NullCap cap; emptyable (ab, bb) s; caps_of_state s (ab, bb) = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb); cdt s (aa, ba) = Some (ab, bb); aa = ab \<longrightarrow> ba \<noteq> bb; cdt s (ab, bb) = Some (ab, bb); cdt s \<Turnstile> (ab, bb) \<rightarrow> (ab, bb)\<rbrakk> \<Longrightarrow> False
 2. \<And>s cap aa ba ab bb. \<lbrakk>replaceable s (ab, bb) NullCap cap; emptyable (ab, bb) s; caps_of_state s (ab, bb) = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb); cdt s (aa, ba) = Some (ab, bb); aa = ab \<longrightarrow> ba \<noteq> bb; cdt s (ab, bb) = Some (ab, bb)\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> (ab, bb) \<rightarrow> (ab, bb)
 3. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl
 4. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (3 subgoals):
 1. \<And>s cap aa ba ab bb. \<lbrakk>replaceable s (ab, bb) NullCap cap; emptyable (ab, bb) s; caps_of_state s (ab, bb) = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb); cdt s (aa, ba) = Some (ab, bb); aa = ab \<longrightarrow> ba \<noteq> bb; cdt s (ab, bb) = Some (ab, bb)\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> (ab, bb) \<rightarrow> (ab, bb)
 2. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (3 subgoals):
 1. \<And>s cap aa ba ab bb. \<lbrakk>replaceable s (ab, bb) NullCap cap; emptyable (ab, bb) s; caps_of_state s (ab, bb) = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb); cdt s (aa, ba) = Some (ab, bb); aa = ab \<longrightarrow> ba \<noteq> bb; cdt s (ab, bb) = Some (ab, bb)\<rbrakk> \<Longrightarrow> cdt s \<Turnstile> (ab, bb) \<leadsto> (ab, bb)
 2. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl
 3. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (2 subgoals):
 1. \<And>s cap a b aa ba ab bb. \<lbrakk>replaceable s sl NullCap cap; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); \<forall>a b aa ba. cdt s (aa, ba) = Some (a, b) \<longrightarrow> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (a, b) = Some c) \<and> (\<exists>c. NullCap \<noteq> c \<and> caps_of_state s (aa, ba) = Some c); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; sl = (ab, bb)\<rbrakk> \<Longrightarrow> cdt s (aa, ba) \<noteq> Some sl \<longrightarrow> (aa, ba) \<noteq> sl \<longrightarrow> cdt s (aa, ba) = Some (a, b) \<longrightarrow> (a, b) \<noteq> sl
 2. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>cte_wp_at (replaceable s sl NullCap) sl s; emptyable sl s; cte_wp_at ((=) cap) sl s; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; inj (interrupt_irq_node s) \<and> (\<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s); valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s)\<rbrakk> \<Longrightarrow> \<forall>vref cap'. cte_wp_at ((=) cap') sl s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> {} = obj_refs cap' \<and> vs_cap_ref NullCap = Some vref \<or> \<not> reachable_pg_cap cap' s \<and> (\<forall>a b. \<exists>aa ba. cte_wp_at (\<lambda>c. gen_obj_refs cap' \<inter> gen_obj_refs c \<noteq> {}) (aa, ba) s = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>\<not> is_final_cap' cap s \<and> \<not> reachable_pg_cap cap s \<or> is_final_cap' cap s \<and> (\<forall>p\<in>zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> sl \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (\<not> is_master_reply_cap cap \<longrightarrow> tcb_cap_valid cap sl s \<longrightarrow> tcb_cap_valid NullCap sl s) \<and> \<not> is_reply_cap NullCap \<and> (\<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s\<rbrakk> \<Longrightarrow> \<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> \<not> reachable_pg_cap cap s \<and> (\<forall>a b. \<exists>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> gen_obj_refs cap \<inter> gen_obj_refs capa \<noteq> {}) = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (2 subgoals):
 1. \<And>s cap. \<lbrakk>\<not> is_final_cap' cap s \<and> \<not> reachable_pg_cap cap s \<or> is_final_cap' cap s \<and> (\<forall>p\<in>zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> sl \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (\<not> is_master_reply_cap cap \<longrightarrow> tcb_cap_valid cap sl s \<longrightarrow> tcb_cap_valid NullCap sl s) \<and> \<not> is_reply_cap NullCap \<and> (\<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; is_final_cap' cap s\<rbrakk> \<Longrightarrow> \<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> \<not> reachable_pg_cap cap s \<and> (\<forall>a b. \<exists>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> gen_obj_refs cap \<inter> gen_obj_refs capa \<noteq> {}) = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s)
 2. \<And>s cap. \<lbrakk>\<not> is_final_cap' cap s \<and> \<not> reachable_pg_cap cap s \<or> is_final_cap' cap s \<and> (\<forall>p\<in>zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> sl \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (\<not> is_master_reply_cap cap \<longrightarrow> tcb_cap_valid cap sl s \<longrightarrow> tcb_cap_valid NullCap sl s) \<and> \<not> is_reply_cap NullCap \<and> (\<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; \<not> is_final_cap' cap s\<rbrakk> \<Longrightarrow> \<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> \<not> reachable_pg_cap cap s \<and> (\<forall>a b. \<exists>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> gen_obj_refs cap \<inter> gen_obj_refs capa \<noteq> {}) = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal (1 subgoal):
 1. \<And>s cap. \<lbrakk>\<not> is_final_cap' cap s \<and> \<not> reachable_pg_cap cap s \<or> is_final_cap' cap s \<and> (\<forall>p\<in>zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (a, b) \<noteq> sl \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (\<not> is_master_reply_cap cap \<longrightarrow> tcb_cap_valid cap sl s \<longrightarrow> tcb_cap_valid NullCap sl s) \<and> \<not> is_reply_cap NullCap \<and> (\<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref NullCap {sl} s; emptyable sl s; caps_of_state s sl = Some cap; cap \<noteq> NullCap; equal_kernel_mappings s; pspace_in_kernel_window s; valid_arch_caps s; valid_arch_state s; valid_asid_map s; valid_global_objs s; valid_global_vspace_mappings s; valid_kernel_mappings s; valid_vspace_objs s; cap_refs_in_kernel_window s; cap_refs_respects_device_region s; tcb_at (cur_thread s) s; if_unsafe_then_cap s; only_idle s; pspace_respects_device_region s; valid_global_refs s; valid_idle s; valid_ioc s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_reply_caps s; valid_reply_masters s; no_mloop (cdt s); descendants_inc (cdt s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); \<forall>a b aa ba c. caps_of_state s (a, b) = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> (\<forall>c'. caps_of_state s (aa, ba) = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s) \<and> usable_untyped_range c = {} \<or> (a, b) \<in> descendants_of (aa, ba) (cdt s) \<and> usable_untyped_range c' = {} \<or> a = aa \<and> b = ba)); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_original_cap s (a, b); mdb_cte_at (\<lambda>p. \<exists>c. NullCap \<noteq> c \<and> caps_of_state s p = Some c) (cdt s); mdb_empty_abs s; valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); inj (interrupt_irq_node s); \<forall>irq. cap_table_at 0 (interrupt_irq_node s irq) s; \<not> is_final_cap' cap s\<rbrakk> \<Longrightarrow> \<forall>vref. vs_cap_ref cap = Some vref \<longrightarrow> \<not> reachable_pg_cap cap s \<and> (\<forall>a b. \<exists>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> gen_obj_refs cap \<inter> gen_obj_refs capa \<noteq> {}) = (aa = a \<longrightarrow> ba \<noteq> b)) \<or> (\<forall>oref\<in>obj_refs cap. (vref, oref) \<notin> vs_lookup_pages s) proof (prove)
goal:
No subgoals!