theory CSpace_R

lemma safe_parent_for_untypedRange:
  "\<lbrakk> safe_parent_for' m p cap; m p = Some cte \<rbrakk> \<Longrightarrow> untypedRange cap \<subseteq> untypedRange (cteCap cte)" apply (clarsimp simp: safe_parent_for'_def) apply (erule disjE) apply clarsimp apply clarsimp apply (simp add: sameRegionAs_def2) apply (erule disjE) apply clarsimp apply (drule capMaster_untypedRange) apply blast apply (erule disjE) apply (clarsimp simp: capRange_Master untypedCapRange) apply (cases "isUntypedCap cap") apply (clarsimp simp: capRange_Master untypedCapRange) apply blast apply (drule notUntypedRange) apply simp apply (clarsimp simp: isCap_Master isCap_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>safe_parent_for' m p cap; m p = Some cte\<rbrakk> \<Longrightarrow> untypedRange cap \<subseteq> untypedRange (cteCap cte) proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; global.sameRegionAs parent cap; (\<exists>irq. cap = capability.IRQHandlerCap irq) \<and> parent = capability.IRQControlCap \<and> (\<forall>p n'. m p \<noteq> Some (CTE cap n')) \<or> isUntypedCap parent \<and> descendants_of' p m = {} \<and> capRange cap \<noteq> {} \<and> capBits cap \<le> capBits parent\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; global.sameRegionAs parent cap; (\<exists>irq. cap = capability.IRQHandlerCap irq) \<and> parent = capability.IRQControlCap \<and> (\<forall>p n'. m p \<noteq> Some (CTE cap n'))\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; global.sameRegionAs parent cap; isUntypedCap parent \<and> descendants_of' p m = {} \<and> capRange cap \<noteq> {} \<and> capBits cap \<le> capBits parent\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; global.sameRegionAs parent cap; isUntypedCap parent \<and> descendants_of' p m = {} \<and> capRange cap \<noteq> {} \<and> capBits cap \<le> capBits parent\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; global.sameRegionAs parent cap; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; capMasterCap parent = capMasterCap cap \<and> capMasterCap parent \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap parent) \<and> \<not> isUntypedCap (capMasterCap parent) \<and> \<not> isArchPageCap (capMasterCap parent) \<and> capMasterCap cap \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap) \<or> capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)) \<or> isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap); isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capMasterCap parent = capMasterCap cap \<and> capMasterCap parent \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap parent) \<and> \<not> isUntypedCap (capMasterCap parent) \<and> \<not> isArchPageCap (capMasterCap parent) \<and> capMasterCap cap \<noteq> capability.NullCap \<and> \<not> isZombie (capMasterCap cap) \<and> \<not> isUntypedCap (capMasterCap cap) \<and> \<not> isArchPageCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)) \<or> isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capMasterCap parent = capMasterCap cap; capMasterCap cap \<noteq> capability.NullCap; \<not> isZombie (capMasterCap cap); \<not> isUntypedCap (capMasterCap cap); \<not> isArchPageCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)) \<or> isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capMasterCap cap \<noteq> capability.NullCap; \<not> isZombie (capMasterCap cap); \<not> isUntypedCap (capMasterCap cap); \<not> isArchPageCap (capMasterCap cap); untypedRange parent = untypedRange cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)) \<or> isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)) \<or> isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange (capMasterCap cap) \<noteq> {} \<and> capRange (capMasterCap cap) \<subseteq> capRange (capMasterCap parent) \<and> (isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap))\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (3 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); isUntypedCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 3. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (3 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; untypedRange cap \<noteq> {}; capBits cap \<le> capBits parent; untypedRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); isUntypedCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 3. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); \<not> isUntypedCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (2 subgoals):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; capRange cap \<subseteq> untypedRange parent; isUntypedCap (capMasterCap parent) \<or> isArchPageCap (capMasterCap parent) \<and> isArchPageCap (capMasterCap cap); untypedRange cap = {}\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent
 2. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal (1 subgoal):
 1. \<And>x parent node. \<lbrakk>m p = Some (CTE parent node); x \<in> untypedRange cap; cte = CTE parent node; isUntypedCap parent; descendants_of' p m = {}; capRange cap \<noteq> {}; capBits cap \<le> capBits parent; isIRQControlCap (capMasterCap parent) \<and> isIRQHandlerCap (capMasterCap cap)\<rbrakk> \<Longrightarrow> x \<in> untypedRange parent proof (prove)
goal:
No subgoals!