theory ArchCSpaceInv_AI

lemma replace_cap_invs:
  "\<lbrace>\<lambda>s. invs s \<and> cte_wp_at (replaceable s p cap) p s
        \<and> cap \<noteq> cap.NullCap
        \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s
        \<and> s \<turnstile> cap\<rbrace>
     set_cap cap p
   \<lbrace>\<lambda>rv s. invs s\<rbrace>" apply (simp add: invs_def valid_state_def valid_mdb_def2) apply (rule hoare_pre) apply (wp replace_cap_valid_pspace
             set_cap_caps_of_state2 set_cap_idle
             replace_cap_ifunsafe valid_irq_node_typ
             set_cap_typ_at set_cap_irq_handlers
             set_cap_valid_arch_caps
             set_cap_cap_refs_respects_device_region_replaceable) apply (clarsimp simp: valid_pspace_def cte_wp_at_caps_of_state replaceable_def) apply (rule conjI) apply (fastforce simp: tcb_cap_valid_def
                   dest!: cte_wp_tcb_cap_valid [OF caps_of_state_cteD]) apply (rule conjI) apply (erule_tac P="\<lambda>cps. mdb_cte_at cps (cdt s)" in rsubst) apply (rule ext) apply (safe del: disjE)[1] apply (simp add: gen_obj_refs_empty final_NullCap)+ apply (rule conjI) apply (simp add: untyped_mdb_def is_cap_simps) apply (erule disjE) apply (clarsimp, rule conjI, clarsimp+)[1] apply (erule allEI, erule allEI) apply (drule_tac x="fst p" in spec, drule_tac x="snd p" in spec) apply (clarsimp simp: gen_obj_refs_subset) apply (drule(1) disjoint_subset, erule (1) notE) apply (rule conjI) apply (erule descendants_inc_minor) apply simp apply (elim disjE) apply clarsimp apply clarsimp apply (rule conjI) apply (erule disjE) apply (simp add: fun_upd_def[symmetric] fun_upd_idem) apply (simp add: untyped_inc_def not_is_untyped_no_range) apply (rule conjI) apply (erule disjE) apply (simp add: fun_upd_def[symmetric] fun_upd_idem) apply (simp add: ut_revocable_def) apply (rule conjI) apply (erule disjE) apply (clarsimp simp: irq_revocable_def) apply clarsimp apply (clarsimp simp: irq_revocable_def) apply (rule conjI) apply (erule disjE) apply (simp add: fun_upd_def[symmetric] fun_upd_idem) apply (simp add: reply_master_revocable_def) apply (rule conjI) apply (erule disjE) apply (simp add: fun_upd_def[symmetric] fun_upd_idem) apply (clarsimp simp add: reply_mdb_def) apply (thin_tac "\<forall>a b. (a, b) \<in> cte_refs cp nd \<and> Q a b\<longrightarrow> R a b" for cp nd Q R) apply (thin_tac "is_pt_cap cap \<longrightarrow> P" for cap P)+ apply (thin_tac "is_pd_cap cap \<longrightarrow> P" for cap P)+ apply (rule conjI) apply (unfold reply_caps_mdb_def)[1] apply (erule allEI, erule allEI) apply (clarsimp split: if_split simp add: is_cap_simps
                 simp del: split_paired_Ex split_paired_All) apply (rename_tac ptra ptrb rights') apply (rule_tac x="(ptra,ptrb)" in exI) apply fastforce apply (unfold reply_masters_mdb_def)[1] apply (erule allEI, erule allEI) apply (fastforce split: if_split_asm simp: is_cap_simps) apply (rule conjI) apply (erule disjE) apply (clarsimp simp add: is_reply_cap_to_def) apply (drule caps_of_state_cteD) apply (subgoal_tac "cte_wp_at (is_reply_cap_to t) p s") apply (erule(1) valid_reply_capsD [OF has_reply_cap_cte_wpD]) apply (erule cte_wp_at_lift) apply(fastforce simp add:is_reply_cap_to_def) apply (simp add: is_cap_simps) apply (frule(1) valid_global_refsD2) apply (frule(1) cap_refs_in_kernel_windowD) apply (rule conjI) apply (erule disjE) apply (clarsimp simp: valid_reply_masters_def cte_wp_at_caps_of_state) apply (cases p,fastforce simp:is_master_reply_cap_to_def) apply (simp add: is_cap_simps) apply (elim disjE) apply simp apply (clarsimp simp: valid_table_capsD[OF caps_of_state_cteD]
                    valid_arch_caps_def unique_table_refs_no_cap_asidE) apply simp apply (rule Ball_emptyI, simp add: gen_obj_refs_subset) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. invs s \<and> cte_wp_at (replaceable s p cap) p s \<and> cap \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s \<and> s \<turnstile> cap\<rbrace> set_cap cap p \<lbrace>\<lambda>rv. invs\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> cte_wp_at (replaceable s p cap) p s \<and> cap \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s \<and> s \<turnstile> cap\<rbrace> set_cap cap p \<lbrace>\<lambda>rv s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> set_cap cap p \<lbrace>\<lambda>rv s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s\<rbrace>
 2. \<And>s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> cte_wp_at (replaceable s p cap) p s \<and> cap \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s \<and> s \<turnstile> cap \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. valid_pspace s \<and> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_ioc s \<and> valid_idle s \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s \<and> cte_wp_at (replaceable s p cap) p s \<and> cap \<noteq> NullCap \<and> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s \<and> s \<turnstile> cap \<Longrightarrow> (valid_pspace s \<and> cte_wp_at (replaceable s p cap) p s \<and> s \<turnstile> cap \<and> tcb_cap_valid cap p s) \<and> mdb_cte_at (\<lambda>pa. \<exists>c. ((caps_of_state s)(p \<mapsto> cap)) pa = Some c \<and> NullCap \<noteq> c) (cdt s) \<and> untyped_mdb (cdt s) ((caps_of_state s)(p \<mapsto> cap)) \<and> descendants_inc (cdt s) ((caps_of_state s)(p \<mapsto> cap)) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) ((caps_of_state s)(p \<mapsto> cap)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(p \<mapsto> cap)) \<and> irq_revocable (is_original_cap s) ((caps_of_state s)(p \<mapsto> cap)) \<and> reply_master_revocable (is_original_cap s) ((caps_of_state s)(p \<mapsto> cap)) \<and> reply_mdb (cdt s) ((caps_of_state s)(p \<mapsto> cap)) \<and> (valid_ioc and (\<lambda>s. cap = NullCap \<longrightarrow> \<not> is_original_cap s p)) s \<and> valid_idle s \<and> only_idle s \<and> (cte_wp_at (replaceable s p cap) p s \<and> if_unsafe_then_cap s \<and> valid_objs s \<and> zombies_final s \<and> (cap \<noteq> NullCap \<longrightarrow> ex_cte_cap_wp_to (appropriate_cte_cap cap) p s)) \<and> (valid_reply_caps and cte_wp_at (\<lambda>_. True) p and (\<lambda>s. \<forall>t rights. cap = ReplyCap t False rights \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (\<not> has_reply_cap t s \<or> cte_wp_at (is_reply_cap_to t) p s))) s \<and> (valid_reply_masters and cte_wp_at (\<lambda>_. True) p and (\<lambda>s. \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2)) s \<and> (valid_global_refs and (\<lambda>s. global_refs s \<inter> cap_range cap = {})) s \<and> valid_arch_state s \<and> valid_irq_node s \<and> (valid_irq_handlers s \<and> cte_wp_at (\<lambda>cap'. \<forall>irq\<in>cap_irqs cap - cap_irqs cap'. irq_issued irq s) p s) \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> (valid_arch_caps s \<and> (\<forall>vref cap'. cte_wp_at ((=) cap') p s \<longrightarrow> vs_cap_ref cap' = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs cap' \<or> \<not> is_final_cap' cap' s \<and> \<not> reachable_pg_cap cap' s \<or> (\<forall>oref\<in>obj_refs cap'. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<or> is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<or> is_pd_cap cap \<longrightarrow> (\<forall>oldcap. caps_of_state s p = Some oldcap \<longrightarrow> is_pt_cap cap \<and> is_pt_cap oldcap \<or> is_pd_cap cap \<and> is_pd_cap oldcap \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid oldcap = None) \<longrightarrow> obj_refs oldcap \<noteq> obj_refs cap) \<longrightarrow> (\<forall>ptr'. cte_wp_at (\<lambda>cap'. obj_refs cap' = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap cap' \<or> is_pt_cap cap \<and> is_pt_cap cap') \<and> (cap_asid cap = None \<or> cap_asid cap' = None)) ptr' s \<longrightarrow> ptr' = p))) \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> (cap_refs_in_kernel_window and (\<lambda>s. \<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow)) s \<and> pspace_respects_device_region s \<and> (cap_refs_respects_device_region and (\<lambda>s. cte_wp_at (replaceable s p cap) p s)) s \<and> cur_tcb s proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> tcb_cap_valid cap p s \<and> mdb_cte_at (\<lambda>pa. pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c)) (cdt s) \<and> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> tcb_cap_valid cap p s
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>pa. pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c)) (cdt s) \<and> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>pa. pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c)) (cdt s) \<and> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>pa. pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c)) (cdt s)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) = (\<lambda>pa. pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa pa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c) = (pa \<noteq> p \<longrightarrow> (\<exists>c. caps_of_state s pa = Some c \<and> NullCap \<noteq> c))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b c. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; caps_of_state s (a, b) = Some c; NullCap \<noteq> c; (a, b) \<noteq> p\<rbrakk> \<Longrightarrow> \<exists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c
 2. \<And>s capa a b. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s (a, b) = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>aa ba. (aa, ba) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((aa, ba) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((aa, ba) \<noteq> (a, b) \<longrightarrow> caps_of_state s (aa, ba) = Some NullCap) \<and> (aa, ba) \<noteq> (a, b)) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa (a, b) s \<longrightarrow> tcb_cap_valid cap (a, b) s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {(a, b)} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (aa, ba) = (a, b))) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>aa ba. (\<exists>capa. caps_of_state s (aa, ba) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (aa, ba) = (a, b))) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) (a, b) s; s \<turnstile> cap; \<nexists>c. caps_of_state s (a, b) = Some c \<and> NullCap \<noteq> c; p = (a, b)\<rbrakk> \<Longrightarrow> False
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> (\<forall>x R. capa \<noteq> ReplyCap x True R) \<and> (\<forall>x R. capa \<noteq> ReplyCap x False R) \<and> ((\<forall>x R. capa \<noteq> ReplyCap x True R) \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> (\<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. cap \<noteq> ReplyCap x True R) \<and> (\<forall>x R. cap \<noteq> ReplyCap x False R) \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> (\<forall>x R. capa \<noteq> ReplyCap x True R) \<and> (\<forall>x R. capa \<noteq> ReplyCap x False R) \<and> ((\<forall>x R. capa \<noteq> ReplyCap x True R) \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> (\<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. cap \<noteq> ReplyCap x True R) \<and> (\<forall>x R. cap \<noteq> ReplyCap x False R) \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); \<forall>a b aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s)); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> (\<forall>x R. capa \<noteq> ReplyCap x True R) \<and> (\<forall>x R. capa \<noteq> ReplyCap x False R) \<and> ((\<forall>x R. capa \<noteq> ReplyCap x True R) \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> (\<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. cap \<noteq> ReplyCap x True R) \<and> (\<forall>x R. cap \<noteq> ReplyCap x False R) \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> (\<forall>x R. capa \<noteq> ReplyCap x True R) \<and> (\<forall>x R. capa \<noteq> ReplyCap x False R) \<and> ((\<forall>x R. capa \<noteq> ReplyCap x True R) \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> (\<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. cap \<noteq> ReplyCap x True R) \<and> (\<forall>x R. cap \<noteq> ReplyCap x False R) \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; \<forall>aa ba cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (aa, ba) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (aa, ba) \<in> descendants_of (a, b) (cdt s))\<rbrakk> \<Longrightarrow> ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> (\<forall>x R. capa \<noteq> ReplyCap x True R) \<and> (\<forall>x R. capa \<noteq> ReplyCap x False R) \<and> ((\<forall>x R. capa \<noteq> ReplyCap x True R) \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> (\<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f) \<and> (\<forall>x R. cap \<noteq> ReplyCap x True R) \<and> (\<forall>x R. cap \<noteq> ReplyCap x False R) \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; \<forall>cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>cap'. caps_of_state s (fst p, snd p) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (fst p, snd p) \<in> descendants_of (a, b) (cdt s))\<rbrakk> \<Longrightarrow> ((a, b) = p \<longrightarrow> (\<exists>dev r bits f. cap = UntypedCap dev r bits f) \<longrightarrow> (\<forall>a b. ((a, b) = p \<longrightarrow> obj_refs cap \<inter> untyped_range cap \<noteq> {} \<longrightarrow> p \<in> descendants_of p (cdt s)) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<forall>cap'. caps_of_state s (a, b) = Some cap' \<longrightarrow> obj_refs cap' \<inter> untyped_range cap \<noteq> {} \<longrightarrow> (a, b) \<in> descendants_of p (cdt s))))) \<and> ((a, b) \<noteq> p \<longrightarrow> (\<exists>a b. (a, b) = p) \<longrightarrow> (\<forall>capa. caps_of_state s (a, b) = Some capa \<longrightarrow> (\<exists>dev r bits f. capa = UntypedCap dev r bits f) \<longrightarrow> obj_refs cap \<inter> untyped_range capa \<noteq> {} \<longrightarrow> p \<in> descendants_of (a, b) (cdt s)))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa a b aa ba dev r bits f. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s (aa, ba) = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) (aa, ba) s; s \<turnstile> cap; is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; \<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a = aa \<longrightarrow> b \<noteq> ba) \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a = aa \<longrightarrow> b \<noteq> ba); obj_refs cap \<subseteq> obj_refs capa; cap_irqs cap \<subseteq> cap_irqs capa; arch_gen_refs cap \<subseteq> arch_gen_refs capa; cap_range cap = cap_range capa; \<forall>x R. capa \<noteq> ReplyCap x True R; \<forall>x R. capa \<noteq> ReplyCap x False R; \<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f; \<forall>x R. cap \<noteq> ReplyCap x True R; \<forall>x R. cap \<noteq> ReplyCap x False R; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {(aa, ba)} s; (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> ((\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> a = aa \<and> b = ba); (\<exists>p asid. cap = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> ((\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> ((\<exists>p asid. capa = ArchObjectCap (PageDirectoryCap p asid)) \<or> (\<exists>p asid. cap = ArchObjectCap (PageTableCap p asid)) \<and> (\<exists>p asid. capa = ArchObjectCap (PageTableCap p asid))) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> a = aa \<and> b = ba); \<not> is_ap_cap cap; p = (aa, ba); a = aa \<longrightarrow> b \<noteq> ba; caps_of_state s (a, b) = Some (UntypedCap dev r bits f); obj_refs cap \<inter> {r..r + 2 ^ bits - 1} \<noteq> {}; tcb_cap_valid capa (aa, ba) s \<longrightarrow> tcb_cap_valid cap (aa, ba) s; (aa, ba) \<notin> descendants_of (a, b) (cdt s); obj_refs capa \<inter> {r..r + 2 ^ bits - 1} = {}\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (if x = p then Some cap else caps_of_state s x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (if x = p then Some cap else caps_of_state s x)) = cap_range (the (caps_of_state s x))
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (if x = p then Some cap else caps_of_state s x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (if x = p then Some cap else caps_of_state s x)) = cap_range (the (caps_of_state s x))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (if x = p then Some cap else caps_of_state s x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (if x = p then Some cap else caps_of_state s x)) = cap_range (the (caps_of_state s x))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (if x = p then Some cap else caps_of_state s x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (if x = p then Some cap else caps_of_state s x)) = cap_range (the (caps_of_state s x))
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (if x = p then Some cap else caps_of_state s x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (if x = p then Some cap else caps_of_state s x)) = cap_range (the (caps_of_state s x))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; \<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> irq_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> reply_master_revocable (is_original_cap s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> reply_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; \<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s); is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p); \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; \<forall>ptr t rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights')); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> \<forall>ptr t rights. (if ptr = p then Some cap else caps_of_state s ptr) = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> (if ptr' = p then Some cap else caps_of_state s ptr') = Some (ReplyCap t True rights'))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa ptr t. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s; \<forall>rights. caps_of_state s ptr = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<forall>rights. (if ptr = p then Some cap else caps_of_state s ptr) = Some (ReplyCap t False rights) \<longrightarrow> (\<exists>ptr' rights'. cdt s ptr = Some ptr' \<and> (if ptr' = p then Some cap else caps_of_state s ptr') = Some (ReplyCap t True rights'))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b t rights aa ba rights'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<forall>x R. capa \<noteq> ReplyCap x True R; \<forall>x R. capa \<noteq> ReplyCap x False R; \<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f; \<forall>x R. cap \<noteq> ReplyCap x True R; \<forall>x R. cap \<noteq> ReplyCap x False R; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s; (a, b) \<noteq> p; caps_of_state s (a, b) = Some (ReplyCap t False rights); cdt s (a, b) = Some (aa, ba); caps_of_state s (aa, ba) = Some (ReplyCap t True rights')\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> p \<and> (ptr' \<noteq> p \<longrightarrow> (aa, ba) = ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights')))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b t rights ptra ptrb rights'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<forall>x R. capa \<noteq> ReplyCap x True R; \<forall>x R. capa \<noteq> ReplyCap x False R; \<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f; \<forall>x R. cap \<noteq> ReplyCap x True R; \<forall>x R. cap \<noteq> ReplyCap x False R; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s; (a, b) \<noteq> p; caps_of_state s (a, b) = Some (ReplyCap t False rights); cdt s (a, b) = Some (ptra, ptrb); caps_of_state s (ptra, ptrb) = Some (ReplyCap t True rights')\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> p \<and> (ptr' \<noteq> p \<longrightarrow> (ptra, ptrb) = ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights')))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa a b t rights ptra ptrb rights'. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<forall>x R. capa \<noteq> ReplyCap x True R; \<forall>x R. capa \<noteq> ReplyCap x False R; \<forall>dev r bits f. cap \<noteq> UntypedCap dev r bits f; \<forall>x R. cap \<noteq> ReplyCap x True R; \<forall>x R. cap \<noteq> ReplyCap x False R; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s; (a, b) \<noteq> p; caps_of_state s (a, b) = Some (ReplyCap t False rights); cdt s (a, b) = Some (ptra, ptrb); caps_of_state s (ptra, ptrb) = Some (ReplyCap t True rights')\<rbrakk> \<Longrightarrow> (ptra, ptrb) \<noteq> p \<and> ((ptra, ptrb) \<noteq> p \<longrightarrow> (ptra, ptrb) = (ptra, ptrb) \<and> (\<exists>rights'. caps_of_state s (ptra, ptrb) = Some (ReplyCap t True rights')))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) (\<lambda>a. if a = p then Some cap else caps_of_state s a)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); \<forall>ptr t rights. caps_of_state s ptr = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s\<rbrakk> \<Longrightarrow> \<forall>ptr t rights. (if ptr = p then Some cap else caps_of_state s ptr) = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. (if ptr' = p then Some cap else caps_of_state s ptr') = Some (ReplyCap t False rights'))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa ptr t. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; reply_caps_mdb (cdt s) (caps_of_state s); is_final_cap' capa s; \<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s; gen_obj_refs cap \<subseteq> gen_obj_refs capa; cap_range cap = cap_range capa; \<not> is_master_reply_cap capa; \<not> is_reply_cap capa; \<not> is_untyped_cap cap; \<not> is_master_reply_cap cap; \<not> is_reply_cap cap; cap \<noteq> IRQControlCap; cap_class cap = cap_class capa; cap_is_device cap = cap_is_device capa; \<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s); no_cap_to_obj_with_diff_ref cap {p} s; \<not> is_ap_cap cap; tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s; \<forall>rights. caps_of_state s ptr = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> \<forall>rights. (if ptr = p then Some cap else caps_of_state s ptr) = Some (ReplyCap t True rights) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. (if ptr' = p then Some cap else caps_of_state s ptr') = Some (ReplyCap t False rights'))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)) \<and> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; capa = cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s t rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; caps_of_state s p = Some (ReplyCap t False rights); ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights\<rbrakk> \<Longrightarrow> st_tcb_at awaiting_reply t s
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s t rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights; cte_wp_at ((=) (ReplyCap t False rights)) p s\<rbrakk> \<Longrightarrow> st_tcb_at awaiting_reply t s
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (4 subgoals):
 1. \<And>s t rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights; cte_wp_at ((=) (ReplyCap t False rights)) p s; cte_wp_at (is_reply_cap_to t) p s\<rbrakk> \<Longrightarrow> st_tcb_at awaiting_reply t s
 2. \<And>s t rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights; cte_wp_at ((=) (ReplyCap t False rights)) p s\<rbrakk> \<Longrightarrow> cte_wp_at (is_reply_cap_to t) p s
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 4. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s t rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights; cte_wp_at ((=) (ReplyCap t False rights)) p s\<rbrakk> \<Longrightarrow> cte_wp_at (is_reply_cap_to t) p s
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s t rights sa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap t False rights)) p s; s \<turnstile> ReplyCap t False rights; cap = ReplyCap t False rights; ReplyCap t False rights = sa\<rbrakk> \<Longrightarrow> is_reply_cap_to t sa
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>t. (\<exists>rights. cap = ReplyCap t False rights) \<longrightarrow> st_tcb_at awaiting_reply t s \<and> (has_reply_cap t s \<longrightarrow> is_reply_cap_to t capa)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> (\<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2) \<and> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; capa = cap\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (3 subgoals):
 1. \<And>s x rights. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; \<forall>a b t. (\<exists>cap. caps_of_state s (a, b) = Some cap \<and> is_master_reply_cap_to t cap) \<longrightarrow> a = t \<and> b = tcb_cnode_index 2; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; caps_of_state s p = Some (ReplyCap x True rights); ex_cte_cap_wp_to (appropriate_cte_cap (ReplyCap x True rights)) p s; s \<turnstile> ReplyCap x True rights; global_refs s \<inter> cap_range (ReplyCap x True rights) = {}; \<forall>ref\<in>cap_range (ReplyCap x True rights). arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; cap = ReplyCap x True rights\<rbrakk> \<Longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 3. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>x. (\<exists>rights. cap = ReplyCap x True rights) \<longrightarrow> fst p = x \<and> snd p = tcb_cnode_index 2
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; capa = cap \<or> is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; capa = cap\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow)
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some cap; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range cap = {}; \<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; capa = cap\<rbrakk> \<Longrightarrow> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s))
 2. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> global_refs s \<inter> cap_range cap = {} \<and> (\<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s) \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> \<not> is_final_cap' capa s \<and> \<not> reachable_pg_cap capa s \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (\<forall>ref\<in>cap_range cap. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>valid_objs s; pspace_aligned s; pspace_distinct s; if_live_then_nonz_cap s; zombies_final s; sym_refs (state_refs_of s); sym_refs (state_hyp_refs_of s); mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; cap \<noteq> NullCap; caps_of_state s p = Some capa; ex_cte_cap_wp_to (appropriate_cte_cap cap) p s; s \<turnstile> cap; global_refs s \<inter> cap_range capa = {}; \<forall>ref\<in>cap_range capa. arm_kernel_vspace (arch_state s) ref = ArmVSpaceKernelWindow; is_final_cap' capa s \<and> (\<forall>p\<in>zobj_refs capa - zobj_refs cap. obj_at (Not \<circ> live) p s) \<and> (\<forall>a b. (a, b) \<in> cte_refs capa (interrupt_irq_node s) \<and> ((a, b) \<in> cte_refs cap (interrupt_irq_node s) \<longrightarrow> (\<exists>cp. appropriate_cte_cap cp capa \<and> \<not> appropriate_cte_cap cp cap)) \<longrightarrow> ((a, b) \<noteq> p \<longrightarrow> caps_of_state s (a, b) = Some NullCap) \<and> (a, b) \<noteq> p) \<and> gen_obj_refs cap \<subseteq> gen_obj_refs capa \<and> cap_range cap = cap_range capa \<and> \<not> is_master_reply_cap capa \<and> \<not> is_reply_cap capa \<and> (\<not> is_master_reply_cap capa \<longrightarrow> tcb_cap_valid capa p s \<longrightarrow> tcb_cap_valid cap p s) \<and> \<not> is_untyped_cap cap \<and> \<not> is_master_reply_cap cap \<and> \<not> is_reply_cap cap \<and> cap \<noteq> IRQControlCap \<and> cap_class cap = cap_class capa \<and> cap_is_device cap = cap_is_device capa \<and> (\<forall>vref. vs_cap_ref capa = Some vref \<longrightarrow> vs_cap_ref cap = Some vref \<and> obj_refs cap = obj_refs capa \<or> (\<forall>oref\<in>obj_refs capa. (vref, oref) \<notin> vs_lookup_pages s)) \<and> no_cap_to_obj_with_diff_ref cap {p} s \<and> (is_pt_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pd_cap cap \<longrightarrow> cap_asid cap = None \<longrightarrow> (\<forall>r\<in>obj_refs cap. obj_at (empty_table (set (second_level_tables (arch_state s)))) r s)) \<and> (is_pt_cap cap \<longrightarrow> (is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap cap \<and> is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap cap \<and> is_pd_cap capa \<or> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> (is_pd_cap cap \<longrightarrow> (is_pt_cap cap \<and> is_pt_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<and> (is_pd_cap capa \<longrightarrow> (cap_asid cap = None \<longrightarrow> cap_asid capa = None) \<longrightarrow> obj_refs capa \<noteq> obj_refs cap) \<longrightarrow> (\<forall>a b. (\<exists>capa. caps_of_state s (a, b) = Some capa \<and> obj_refs capa = obj_refs cap \<and> (is_pd_cap capa \<or> is_pt_cap cap \<and> is_pt_cap capa) \<and> (cap_asid cap = None \<or> cap_asid capa = None)) \<longrightarrow> (a, b) = p)) \<and> \<not> is_ap_cap cap\<rbrakk> \<Longrightarrow> \<forall>irq\<in>cap_irqs cap - cap_irqs capa. irq_issued irq s proof (prove)
goal:
No subgoals!