theory CSpace_AI

lemma set_free_index_valid_mdb:
  "\<lbrace>\<lambda>s. valid_objs s \<and> valid_mdb s \<and> cte_wp_at ((=) cap ) cref s \<and>
        (free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2^cap_bits cap)\<rbrace>
   set_cap (free_index_update (\<lambda>_. idx) cap) cref
   \<lbrace>\<lambda>rv s'. valid_mdb s'\<rbrace>" apply (simp add:valid_mdb_def) apply (rule hoare_pre) apply (wp set_cap_mdb_cte_at) apply (wps set_cap_rvk_cdt_ct_ms) apply wp apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps free_index_of_def
                        reply_master_revocable_def irq_revocable_def reply_mdb_def
                  simp del: untyped_range.simps usable_untyped_range.simps) unfolding fun_upd_def[symmetric] apply (simp) apply (frule(1) caps_of_state_valid) proof(intro conjI impI) fix s bits f r dev assume mdb:"untyped_mdb (cdt s) (caps_of_state s)" assume cstate:"caps_of_state s cref = Some (UntypedCap dev r bits f)" (is "?m cref = Some ?srccap") show "untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply (rule untyped_mdb_update_free_index
     [where capa = ?srccap and m = "caps_of_state s" and src = cref,
       unfolded free_index_update_def,simplified,THEN iffD2]) apply (simp add:cstate mdb)+ done assume arch_mdb:"valid_arch_mdb (is_original_cap s) (caps_of_state s)" show "valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply (rule valid_arch_mdb_updates(1)[where capa = ?srccap
                               and m="caps_of_state s" and src=cref,
                               unfolded free_index_update_def, simplified, THEN iffD2]) apply (simp add: cstate arch_mdb)+ done assume inc: "untyped_inc (cdt s) (caps_of_state s)" have untyped_range_simp: "untyped_range (cap.UntypedCap dev r bits f) = untyped_range (cap.UntypedCap dev r bits idx)" by simp assume valid: "s \<turnstile> cap.UntypedCap dev r bits f" assume cmp: "f \<le> idx" "idx \<le> 2 ^ bits" have subset_range: "usable_untyped_range (cap.UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (cap.UntypedCap dev r bits f)" using cmp valid apply (clarsimp simp:valid_cap_def cap_aligned_def) apply (rule word_plus_mono_right) apply (rule of_nat_mono_maybe_le[THEN iffD1]) apply (subst word_bits_def[symmetric]) apply (erule less_le_trans[OF _  power_increasing]) apply simp apply simp apply (subst word_bits_def[symmetric]) apply (erule le_less_trans) apply (erule less_le_trans[OF _ power_increasing]) apply simp+ apply (erule is_aligned_no_wrap') apply (rule word_of_nat_less) apply (simp add: word_bits_def) done note blah[simp del] = untyped_range.simps usable_untyped_range.simps show "untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using inc cstate apply (unfold untyped_inc_def) apply (intro allI impI) apply (drule_tac x = p in spec) apply (drule_tac x = p' in spec) apply (case_tac "p = cref") apply (simp) apply (case_tac "p' = cref") apply simp apply (simp add:untyped_range_simp) apply (intro conjI impI) apply (simp) apply (elim conjE) apply (drule disjoint_subset2[OF subset_range,rotated]) apply simp+ using subset_range apply clarsimp apply (case_tac "p' = cref") apply simp apply (intro conjI) apply (elim conjE) apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply (simp add:untyped_range_simp)+ apply (intro impI) apply (elim conjE | simp)+ apply (drule disjoint_subset2[OF subset_range,rotated]) apply simp apply (intro impI) apply (elim conjE | simp add:untyped_range_simp)+ apply (intro impI) apply (elim conjE | simp add:untyped_range_simp)+ using subset_range apply clarsimp+ done assume "ut_revocable (is_original_cap s) (caps_of_state s)" thus "ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using cstate by (fastforce simp:ut_revocable_def) assume "reply_caps_mdb (cdt s) (caps_of_state s)" thus "reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using cstate apply (simp add:reply_caps_mdb_def del:split_paired_All split_paired_Ex) apply (intro allI impI conjI) apply (drule spec)+ apply (erule(1) impE) apply (erule exE)+ apply (rule_tac x = ptr' in exI) apply simp+ apply fastforce done assume "reply_masters_mdb (cdt s) (caps_of_state s)" thus "reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply (simp add:reply_masters_mdb_def del:split_paired_All split_paired_Ex) apply (intro allI impI ballI) apply (erule exE) apply (elim allE impE) apply fastforce using cstate apply fastforce done assume mdb:"mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)"
  and desc_inc:"descendants_inc (cdt s) (caps_of_state s)"
  and cte:"caps_of_state s cref = Some (cap.UntypedCap dev r bits f)" show "descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using mdb cte apply (clarsimp simp:swp_def cte_wp_at_caps_of_state) apply (erule descendants_inc_minor[OF desc_inc]) apply (clarsimp simp:cap_range_def untyped_range.simps) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_objs s \<and> valid_mdb s \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap\<rbrace> set_cap (free_index_update (\<lambda>_. idx) cap) cref \<lbrace>\<lambda>rv. valid_mdb\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap\<rbrace> set_cap (free_index_update (\<lambda>_. idx) cap) cref \<lbrace>\<lambda>rv s'. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s') (cdt s') \<and> untyped_mdb (cdt s') (caps_of_state s') \<and> descendants_inc (cdt s') (caps_of_state s') \<and> no_mloop (cdt s') \<and> untyped_inc (cdt s') (caps_of_state s') \<and> ut_revocable (is_original_cap s') (caps_of_state s') \<and> irq_revocable (is_original_cap s') (caps_of_state s') \<and> reply_master_revocable (is_original_cap s') (caps_of_state s') \<and> reply_mdb (cdt s') (caps_of_state s') \<and> valid_arch_mdb (is_original_cap s') (caps_of_state s')\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> set_cap (free_index_update (\<lambda>_. idx) cap) cref \<lbrace>\<lambda>rv s'. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s') (cdt s') \<and> untyped_mdb (cdt s') (caps_of_state s') \<and> descendants_inc (cdt s') (caps_of_state s') \<and> no_mloop (cdt s') \<and> untyped_inc (cdt s') (caps_of_state s') \<and> ut_revocable (is_original_cap s') (caps_of_state s') \<and> irq_revocable (is_original_cap s') (caps_of_state s') \<and> reply_master_revocable (is_original_cap s') (caps_of_state s') \<and> reply_mdb (cdt s') (caps_of_state s') \<and> valid_arch_mdb (is_original_cap s') (caps_of_state s')\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'4\<rbrace> set_cap (free_index_update (\<lambda>_. idx) cap) cref \<lbrace>\<lambda>rv s. untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> free_index_update (\<lambda>_. idx) cap)) \<and> ?P'4 s proof (prove)
goal (2 subgoals):
 1. \<And>prev_s. \<lbrace>?P7 prev_s\<rbrace> set_cap (free_index_update (\<lambda>_. idx) cap) cref \<lbrace>\<lambda>rv s'. untyped_mdb (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> descendants_inc (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> no_mloop (cdt prev_s) \<and> untyped_inc (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> ut_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> irq_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> reply_master_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> reply_mdb (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> valid_arch_mdb (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap))\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> free_index_update (\<lambda>_. idx) cap)) \<and> ?P7 s s proof (prove)
goal (1 subgoal):
 1. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> cte_wp_at ((=) cap) cref s \<and> free_index_of cap \<le> idx \<and> is_untyped_cap cap \<and> idx \<le> 2 ^ cap_bits cap \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> free_index_update (\<lambda>_. idx) cap)) \<and> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> irq_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> reply_master_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> reply_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> reply_caps_mdb (cdt s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) \<and> valid_arch_mdb (is_original_cap s) (\<lambda>a. if a = cref then Some (free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f)) else caps_of_state s a) proof (prove)
goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> free_index_update (\<lambda>_. idx) (UntypedCap dev r bits f))) proof (prove)
goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
goal (7 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 7. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
goal (7 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 7. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
untyped_mdb (cdt s) (caps_of_state s)

goal (7 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 7. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (7 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 7. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (3 subgoals):
 1. caps_of_state s cref = Some (UntypedCap dev r bits f)
 2. (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx) = (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits ?x1)
 3. untyped_mdb (cdt s) (caps_of_state s) proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (6 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
valid_arch_mdb (is_original_cap s) (caps_of_state s)

goal (6 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 6. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (3 subgoals):
 1. caps_of_state s cref = Some (UntypedCap dev r bits f)
 2. (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx) = (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits ?x1)
 3. valid_arch_mdb (is_original_cap s) (caps_of_state s) proof (prove)
goal:
No subgoals! proof (state)
this:
valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
untyped_inc (cdt s) (caps_of_state s)

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. untyped_range (UntypedCap dev r bits f) = untyped_range (UntypedCap dev r bits idx) proof (state)
this:
untyped_range (UntypedCap dev r bits f) = untyped_range (UntypedCap dev r bits idx)

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
s \<turnstile> UntypedCap dev r bits f

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
f \<le> idx
idx \<le> 2 ^ bits

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. usable_untyped_range (UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (UntypedCap dev r bits f) proof (prove)
using this:
f \<le> idx
idx \<le> 2 ^ bits
s \<turnstile> UntypedCap dev r bits f

goal (1 subgoal):
 1. usable_untyped_range (UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (UntypedCap dev r bits f) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r + word_of_nat f \<le> r + word_of_nat idx proof (prove)
goal (2 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> word_of_nat f \<le> word_of_nat idx
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (4 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> idx < 2 ^ LENGTH(32)
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ LENGTH(32)
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 4. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (4 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> idx < 2 ^ word_bits
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ LENGTH(32)
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 4. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (5 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> bits \<le> word_bits
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> 1 \<le> 2
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ LENGTH(32)
 4. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 5. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (4 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> 1 \<le> 2
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ LENGTH(32)
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 4. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (3 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ LENGTH(32)
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (3 subgoals):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f < 2 ^ word_bits
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (3 subgoals):
 1. \<lbrakk>is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> idx < 2 ^ word_bits
 2. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (4 subgoals):
 1. \<lbrakk>is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> bits \<le> word_bits
 2. \<lbrakk>is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> 1 \<le> 2
 3. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> f \<le> idx
 4. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<le> idx; is_aligned r bits; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> r \<le> r + word_of_nat idx proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<le> idx; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> word_of_nat idx < 2 ^ bits proof (prove)
goal (1 subgoal):
 1. \<lbrakk>f \<le> idx; bits < word_bits; valid_untyped (UntypedCap dev r bits f) s; untyped_min_bits \<le> bits; r \<noteq> 0; idx < 2 ^ bits; r + word_of_nat idx \<le> r + 2 ^ bits - 1\<rbrakk> \<Longrightarrow> idx < unat (2 ^ bits) proof (prove)
goal:
No subgoals! proof (state)
this:
usable_untyped_range (UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (UntypedCap dev r bits f)

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
untyped_range (UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range NullCap = {}
untyped_range (EndpointCap ?r ?badge ?rights) = {}
untyped_range (NotificationCap ?r ?badge ?rights) = {}
untyped_range (CNodeCap ?r ?bits ?guard) = {}
untyped_range (ThreadCap ?r) = {}
untyped_range DomainCap = {}
untyped_range (ReplyCap ?r ?master ?rights) = {}
untyped_range IRQControlCap = {}
untyped_range (IRQHandlerCap ?irq) = {}
untyped_range (Zombie ?r ?b ?n) = {}
untyped_range (ArchObjectCap ?cap) = {}
usable_untyped_range (UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})

goal (5 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 5. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
untyped_inc (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<forall>p p' c c'. ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {} \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}; untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits idx) = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
using this:
usable_untyped_range (UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (UntypedCap dev r bits f)

goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits idx) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
using this:
usable_untyped_range (UntypedCap dev r bits idx) \<subseteq> usable_untyped_range (UntypedCap dev r bits f)

goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (4 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
ut_revocable (is_original_cap s) (caps_of_state s)

goal (4 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 4. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
ut_revocable (is_original_cap s) (caps_of_state s)

goal (1 subgoal):
 1. ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
ut_revocable (is_original_cap s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (3 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
reply_caps_mdb (cdt s) (caps_of_state s)

goal (3 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 3. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
reply_caps_mdb (cdt s) (caps_of_state s)

goal (1 subgoal):
 1. reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
reply_caps_mdb (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<forall>ptr. ptr \<noteq> cref \<longrightarrow> (\<forall>t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))); caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); (\<exists>rights. caps_of_state s (?ptr29 ptr t) = Some (ReplyCap (?t31 ptr t) False rights)) \<longrightarrow> (\<exists>ptr'. cdt s (?ptr29 ptr t) = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap (?t31 ptr t) True rights')))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); \<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t rights ptr'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t rights ptr'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t rights ptr'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal:
No subgoals! proof (state)
this:
reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (2 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
reply_masters_mdb (cdt s) (caps_of_state s)

goal (2 subgoals):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))
 2. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
reply_masters_mdb (cdt s) (caps_of_state s)

goal (1 subgoal):
 1. reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')) \<Longrightarrow> \<forall>ptr. ptr \<noteq> cref \<longrightarrow> (\<exists>t rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> (\<forall>ptr'\<in>descendants_of ptr (cdt s). ptr' \<noteq> cref) proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr'. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); ptr \<noteq> cref; \<exists>t rights. caps_of_state s ptr = Some (ReplyCap t True rights); ptr' \<in> descendants_of ptr (cdt s)\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (2 subgoals):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)\<rbrakk> \<Longrightarrow> \<exists>rights. caps_of_state s (?ptr36 ptr ptr' t) = Some (ReplyCap (?t37 ptr ptr' t) True rights)
 2. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s (?ptr36 ptr ptr' t) = None \<and> (\<forall>ptr'a\<in>descendants_of (?ptr36 ptr ptr' t) (cdt s). \<exists>rights'. caps_of_state s ptr'a = Some (ReplyCap (?t37 ptr ptr' t) False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
using this:
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal:
No subgoals! proof (state)
this:
reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)
descendants_inc (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. \<And>s dev r bits f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f); f \<le> idx; idx \<le> 2 ^ bits; cap = UntypedCap dev r bits f; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_cte_at (\<lambda>y. \<exists>cap. caps_of_state s y = Some cap \<and> NullCap \<noteq> cap) (cdt s); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. caps_of_state s cref = Some (UntypedCap dev r bits f) \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_range (the (caps_of_state s x)) proof (prove)
goal:
No subgoals! proof (state)
this:
descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal:
No subgoals!