theory CSpace_AI

lemma cap_insert_mdb [wp]:
  "\<lbrace>valid_mdb and valid_cap cap and valid_objs and
    (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s)
    and K (src \<noteq> dest) \<rbrace>
    cap_insert cap src dest
   \<lbrace>\<lambda>_. valid_mdb\<rbrace>" apply (simp add:valid_mdb_def) apply (wp cap_insert_mdb_cte_at) apply (simp add: cap_insert_def set_untyped_cap_as_full_def update_cdt_def set_cdt_def bind_assoc) apply (wp | simp del: fun_upd_apply split del: if_split)+ apply (rule hoare_lift_Pf3[where f="is_original_cap"]) apply (wp set_cap_caps_of_state2 get_cap_wp |simp del: fun_upd_apply split del: if_split)+ apply (clarsimp simp: cte_wp_at_caps_of_state split del: if_split) apply (subgoal_tac "mdb_insert_abs (cdt s) src dest") prefer 2 apply (rule mdb_insert_abs.intro,simp+) apply (erule mdb_cte_at_cdt_null,simp) apply (rule mdb_cte_at_Null_descendants) apply (assumption) apply (simp add:mdb_cte_at_rewrite) apply (subgoal_tac "mdb_insert_abs_sib (cdt s) src dest") prefer 2 apply (erule mdb_insert_abs_sib.intro) apply (case_tac "should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)") apply simp apply (frule (4) mdb_insert_abs.untyped_mdb) apply (frule (4) mdb_insert_abs.reply_mdb) apply (simp) apply (rule conjI) apply (simp add: no_mloop_def mdb_insert_abs.parency) apply (intro allI impI conjI) apply (rule_tac m1 = "(caps_of_state s)(dest\<mapsto> cap)"
                        and src1 = src in iffD2[OF untyped_mdb_update_free_index,rotated,rotated]) apply (simp add:fun_upd_twist)+ apply (drule_tac cs' = "(caps_of_state s)(src \<mapsto> max_free_index_update capa)" in descendants_inc_minor) apply (clarsimp simp:cte_wp_at_caps_of_state swp_def) apply clarsimp apply (subst upd_commute) apply simp apply (erule(1) mdb_insert_abs.descendants_inc) apply simp apply (clarsimp dest!:is_derived_cap_class_range) apply (rule notI) apply (simp add: mdb_insert_abs.dest_no_parent_trancl) apply (erule mdb_insert_abs.untyped_inc_simple) apply (rule_tac m = "caps_of_state s" and src = src in untyped_inc_update_free_index) apply (simp add:fun_upd_twist)+ apply (frule_tac p = src in caps_of_state_valid,assumption) apply (clarsimp simp:valid_cap_def) apply clarsimp+ apply (clarsimp simp:is_cap_simps)+ apply (simp add:is_derived_def) apply (clarsimp simp:is_cap_simps) apply (clarsimp simp:ut_revocable_def is_cap_simps is_cap_revocable_def) apply (clarsimp simp: irq_revocable_def is_cap_revocable_def) apply (intro impI conjI) apply (clarsimp simp:is_cap_simps free_index_update_def)+ apply (clarsimp simp: reply_master_revocable_def is_derived_def is_master_reply_cap_def is_cap_revocable_def) apply clarsimp apply (rule_tac m1 = "(caps_of_state s)(dest\<mapsto> cap)"
                   and src1 = src in reply_mdb_update_free_index[THEN iffD2]) apply ((simp add:fun_upd_twist)+)[3] apply (clarsimp simp:is_cap_simps is_cap_revocable_def) apply (rule valid_arch_mdb_updates, simp add: is_cap_simps) apply simp apply (simp add: no_mloop_def mdb_insert_abs.parency) apply (intro impI conjI allI) apply (erule(1) mdb_insert_abs.descendants_inc) apply simp apply (clarsimp dest!:is_derived_cap_class_range) apply (rule notI) apply (simp add: mdb_insert_abs.dest_no_parent_trancl) apply (frule_tac p = src in caps_of_state_valid,assumption) apply (erule mdb_insert_abs.untyped_inc) apply simp+ apply (simp add:valid_cap_def) apply simp+ apply (clarsimp simp:is_derived_def is_cap_simps cap_master_cap_simps dest!:cap_master_cap_eqDs) apply (clarsimp simp:ut_revocable_def is_cap_simps,simp add:is_cap_revocable_def) apply (clarsimp simp: irq_revocable_def is_cap_revocable_def) apply (clarsimp simp: reply_master_revocable_def is_derived_def is_master_reply_cap_def is_cap_revocable_def) apply (erule (1) valid_arch_mdb_updates) apply (clarsimp) apply (intro impI conjI allI) apply (rule_tac m1 = "(caps_of_state s)(dest\<mapsto> cap)"
                              and src1 = src in iffD2[OF untyped_mdb_update_free_index,rotated,rotated]) apply (frule mdb_insert_abs_sib.untyped_mdb_sib) apply (simp add:fun_upd_twist)+ apply (drule_tac cs' = "(caps_of_state s)(src \<mapsto> max_free_index_update capa)" in descendants_inc_minor) apply (clarsimp simp:cte_wp_at_caps_of_state swp_def) apply clarsimp apply (subst upd_commute) apply simp apply (erule(1) mdb_insert_abs_sib.descendants_inc) apply simp apply (clarsimp dest!:is_derived_cap_class_range) apply (simp add: no_mloop_def) apply (simp add: mdb_insert_abs_sib.parent_n_eq) apply (simp add: mdb_insert_abs.dest_no_parent_trancl) apply (rule_tac m = "(caps_of_state s)(dest\<mapsto> cap)" and src = src in untyped_inc_update_free_index) apply (simp add:fun_upd_twist)+ apply (frule(3) mdb_insert_abs_sib.untyped_inc) apply (frule_tac p = src in caps_of_state_valid,assumption) apply (simp add:valid_cap_def) apply (simp add:valid_cap_def,
                          clarsimp simp:ut_revocable_def,case_tac src,
                          clarsimp,simp) apply (clarsimp simp:ut_revocable_def is_cap_simps is_cap_revocable_def) apply (clarsimp simp: irq_revocable_def is_cap_revocable_def) apply (intro impI conjI) apply (clarsimp simp:is_cap_simps free_index_update_def)+ apply (clarsimp simp: reply_master_revocable_def is_derived_def is_master_reply_cap_def is_cap_revocable_def) apply (rule_tac m1 = "(caps_of_state s)(dest\<mapsto> cap)"
                      and src1 = src in iffD2[OF reply_mdb_update_free_index,rotated,rotated]) apply (frule mdb_insert_abs_sib.reply_mdb_sib,simp+) apply (clarsimp simp:ut_revocable_def,case_tac src,clarsimp,simp) apply (simp add:fun_upd_twist)+ apply (erule (1) valid_arch_mdb_updates, clarsimp) apply (frule mdb_insert_abs_sib.untyped_mdb_sib) apply (simp add:fun_upd_twist)+ apply (erule(1) mdb_insert_abs_sib.descendants_inc) apply simp apply (clarsimp dest!: is_derived_cap_class_range) apply (simp add: no_mloop_def) apply (simp add: mdb_insert_abs_sib.parent_n_eq) apply (simp add: mdb_insert_abs.dest_no_parent_trancl) apply (frule(3) mdb_insert_abs_sib.untyped_inc) apply (simp add:valid_cap_def) apply (case_tac src,clarsimp simp:ut_revocable_def) apply simp apply (clarsimp simp:ut_revocable_def is_cap_simps,simp add: is_cap_revocable_def) apply (clarsimp simp: irq_revocable_def is_cap_revocable_def) apply (clarsimp simp: reply_master_revocable_def is_derived_def is_master_reply_cap_def) apply (frule mdb_insert_abs_sib.reply_mdb_sib,simp+) apply (clarsimp simp:reply_master_revocable_def,case_tac src,clarsimp) apply simp apply (erule (1) valid_arch_mdb_updates) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_mdb and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and K (src \<noteq> dest)\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>_. valid_mdb\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>(\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and (\<lambda>y. src \<noteq> dest)\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>_ s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'1\<rbrace> cap_insert cap src dest \<lbrace>\<lambda>rv s. untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace>
 2. \<And>s. ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and (\<lambda>y. src \<noteq> dest)) s \<Longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)) and (\<lambda>s. no_mloop (cdt s)) and valid_cap cap and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and K (src \<noteq> dest)) s \<and> ?P'1 s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'1\<rbrace> do src_cap <- get_cap src;
old_cap <- get_cap dest;
y <- assert (old_cap = NullCap);
y <- if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return ();
y <- set_cap cap dest;
is_original <- gets is_original_cap;
src_p <- gets (\<lambda>s. cdt s src);
dest_p <- gets (\<lambda>s. cdt s dest);
x <- gets cdt;
xa <- get;
y <- put (xa\<lparr>cdt := x(dest := if should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap) then Some src else x src)\<rparr>);
y <- do_extended_op (cap_insert_ext (should_be_parent_of src_cap (is_original src) cap (is_cap_revocable cap src_cap)) src dest src_p dest_p);
set_original dest (is_cap_revocable cap src_cap)
od \<lbrace>\<lambda>rv s. untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace>
 2. \<And>s. ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and (\<lambda>y. src \<noteq> dest)) s \<Longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)) and (\<lambda>s. no_mloop (cdt s)) and valid_cap cap and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and K (src \<noteq> dest)) s \<and> ?P'1 s proof (prove)
goal (6 subgoals):
 1. \<And>src_cap x. \<lbrace>?B7 src_cap x () ()\<rbrace> set_cap cap dest \<lbrace>\<lambda>yb s. untyped_mdb ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src)) (caps_of_state s) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src)) (caps_of_state s) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src)) (caps_of_state s) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap src_cap)) (caps_of_state s) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap src_cap)) (caps_of_state s) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap src_cap)) (caps_of_state s) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of src_cap (is_original_cap s src) cap (is_cap_revocable cap src_cap) then Some src else cdt s src)) (caps_of_state s) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap src_cap)) (caps_of_state s)\<rbrace>
 2. \<And>src_cap x y. \<lbrace>?B6 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>?B7 src_cap x y\<rbrace>
 3. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B6 src_cap x\<rbrace>
 4. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 5. \<lbrace>?P'1\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 6. \<And>s. ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and (\<lambda>y. src \<noteq> dest)) s \<Longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)) and (\<lambda>s. no_mloop (cdt s)) and valid_cap cap and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and K (src \<noteq> dest)) s \<and> ?P'1 s proof (prove)
goal (7 subgoals):
 1. \<And>src_cap x xa. \<lbrace>?Q40 src_cap x xa\<rbrace> set_cap cap dest \<lbrace>\<lambda>a b. untyped_mdb ((cdt b)(dest := if should_be_parent_of src_cap (xa src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src)) (caps_of_state b) \<and> descendants_inc ((cdt b)(dest := if should_be_parent_of src_cap (xa src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src)) (caps_of_state b) \<and> no_mloop ((cdt b)(dest := if should_be_parent_of src_cap (xa src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src)) \<and> untyped_inc ((cdt b)(dest := if should_be_parent_of src_cap (xa src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src)) (caps_of_state b) \<and> ut_revocable (xa(dest := is_cap_revocable cap src_cap)) (caps_of_state b) \<and> irq_revocable (xa(dest := is_cap_revocable cap src_cap)) (caps_of_state b) \<and> reply_master_revocable (xa(dest := is_cap_revocable cap src_cap)) (caps_of_state b) \<and> reply_mdb ((cdt b)(dest := if should_be_parent_of src_cap (xa src) cap (is_cap_revocable cap src_cap) then Some src else cdt b src)) (caps_of_state b) \<and> valid_arch_mdb (xa(dest := is_cap_revocable cap src_cap)) (caps_of_state b)\<rbrace>
 2. \<And>src_cap x P. \<lbrace>\<lambda>s. P (is_original_cap s)\<rbrace> set_cap cap dest \<lbrace>\<lambda>_ s. P (is_original_cap s)\<rbrace>
 3. \<And>src_cap x y. \<lbrace>?B6 src_cap x y\<rbrace> if is_untyped_cap src_cap \<and> is_untyped_cap cap \<and> obj_ref_of src_cap = obj_ref_of cap \<and> cap_bits_untyped src_cap = cap_bits_untyped cap then set_cap (max_free_index_update src_cap) src else return () \<lbrace>?B7 src_cap x y\<rbrace>
 4. \<And>src_cap x. \<lbrace>?B5 src_cap x\<rbrace> assert (x = NullCap) \<lbrace>?B6 src_cap x\<rbrace>
 5. \<And>src_cap. \<lbrace>?B4 src_cap\<rbrace> get_cap dest \<lbrace>?B5 src_cap\<rbrace>
 6. \<lbrace>?P'1\<rbrace> get_cap src \<lbrace>?B4\<rbrace>
 7. \<And>s. ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)) and valid_cap cap and valid_objs and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and (\<lambda>y. src \<noteq> dest)) s \<Longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)) and (\<lambda>s. no_mloop (cdt s)) and valid_cap cap and (\<lambda>s. cte_wp_at (is_derived (cdt s) src cap) src s) and K (src \<noteq> dest)) s \<and> ?P'1 s
flex-flex pairs:
\<lambda>src_cap x s. ?Q40 src_cap x (is_original_cap s) s \<equiv>\<^sup>? \<lambda>src_cap x. ?B7 src_cap x () () proof (prove)
goal (1 subgoal):
 1. \<And>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> s \<turnstile> cap \<and> valid_objs s \<and> cte_wp_at (is_derived (cdt s) src cap) src s \<and> src \<noteq> dest \<Longrightarrow> \<forall>capa. cte_wp_at ((=) capa) src s \<longrightarrow> cte_wp_at ((=) NullCap) dest s \<longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt s) src dest proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> mdb_insert_abs (cdt s) src dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> cdt s dest = None
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> descendants_of dest (cdt s) = {}
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> descendants_of dest (cdt s) = {}
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> ?cs156 s capa dest = Some NullCap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. ?cs156 s capa p = Some c \<and> NullCap \<noteq> c) (cdt s)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib (cdt s) src dest proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest\<rbrakk> \<Longrightarrow> mdb_insert_abs_sib (cdt s) src dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> (\<forall>a b. cdt s \<Turnstile> (a, b) \<rightarrow> src \<longrightarrow> (a, b) \<noteq> dest) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa200 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x200 s capa) (?capa200 s capa))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (12 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_range (the (caps_of_state s x))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 4. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_range (the (caps_of_state s x))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 3. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) src = Some (?c217 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (?c217 s capa) \<and> cap_range cap \<subseteq> cap_range (?c217 s capa)
 3. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (max_free_index_update capa) \<and> cap_range cap \<subseteq> cap_range (max_free_index_update capa)
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (9 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (9 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src; (a, b) = dest\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (15 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) src = Some (?c227 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_aligned (?c227 s capa)
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) dest = Some NullCap
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range (?c227 s capa) \<or> \<not> is_untyped_cap cap
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (?c227 s capa)
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (?c227 s capa) \<longrightarrow> usable_untyped_range (?c227 s capa) = {}
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?cap236 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa) = (caps_of_state s)(src \<mapsto> max_free_index_update (?cap236 s capa))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (caps_of_state s)
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) src = Some (?c227 s capa)
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_aligned (?c227 s capa)
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) dest = Some NullCap
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range (?c227 s capa) \<or> \<not> is_untyped_cap cap
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (?c227 s capa)
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (?c227 s capa) \<longrightarrow> usable_untyped_range (?c227 s capa) = {}
A total of 17 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_aligned (max_free_index_update capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) dest = Some NullCap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range (max_free_index_update capa) \<or> \<not> is_untyped_cap cap
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa)
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> cap_aligned (max_free_index_update capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) dest = Some NullCap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range (max_free_index_update capa) \<or> \<not> is_untyped_cap cap
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa)
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) dest = Some NullCap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range (max_free_index_update capa) \<or> \<not> is_untyped_cap cap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa)
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_range cap = untyped_range capa
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> descendants_of src (cdt s) = {}
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s dev f deva ra bitsa fa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> UntypedCap deva ra bitsa fa; valid_objs s; src \<noteq> dest; is_derived (cdt s) src (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f); caps_of_state s src = Some (UntypedCap dev ra bitsa f); caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of (UntypedCap dev ra bitsa f) (is_original_cap s src) (UntypedCap deva ra bitsa fa) (is_cap_revocable (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f)); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); cap = UntypedCap deva ra bitsa fa\<rbrakk> \<Longrightarrow> descendants_of src (cdt s) = {}
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap (max_free_index_update capa) \<longrightarrow> usable_untyped_range (max_free_index_update capa) = {}
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((a, b) = src \<longrightarrow> max_free_index_update capa = IRQControlCap \<longrightarrow> is_original_cap s src) \<and> ((a, b) \<noteq> src \<longrightarrow> (a, b) = dest \<longrightarrow> cap \<noteq> IRQControlCap)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; (a, b) = src; max_free_index_update capa = IRQControlCap\<rbrakk> \<Longrightarrow> is_original_cap s src
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; (a, b) \<noteq> src; (a, b) = dest\<rbrakk> \<Longrightarrow> cap \<noteq> IRQControlCap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s dev f deva ra bitsa fa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> UntypedCap deva ra bitsa fa; valid_objs s; src \<noteq> dest; is_derived (cdt s) src (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f); caps_of_state s src = Some (UntypedCap dev ra bitsa f); caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of (UntypedCap dev ra bitsa f) (is_original_cap s src) (UntypedCap deva ra bitsa fa) (is_cap_revocable (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f)); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); cap = UntypedCap deva ra bitsa fa\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f))) ((caps_of_state s)(src \<mapsto> UntypedCap dev ra bitsa (max_free_index bitsa), dest \<mapsto> UntypedCap deva ra bitsa fa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa447 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x447 s capa) (?capa447 s capa))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s dev f deva ra bitsa fa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> UntypedCap deva ra bitsa fa; valid_objs s; src \<noteq> dest; is_derived (cdt s) src (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f); caps_of_state s src = Some (UntypedCap dev ra bitsa f); caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of (UntypedCap dev ra bitsa f) (is_original_cap s src) (UntypedCap deva ra bitsa fa) True; untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); cap = UntypedCap deva ra bitsa fa\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := True)) ((caps_of_state s)(src \<mapsto> UntypedCap dev ra bitsa (max_free_index bitsa), dest \<mapsto> UntypedCap deva ra bitsa fa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s dev f deva ra bitsa fa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> UntypedCap deva ra bitsa fa; valid_objs s; src \<noteq> dest; is_derived (cdt s) src (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f); caps_of_state s src = Some (UntypedCap dev ra bitsa f); caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of (UntypedCap dev ra bitsa f) (is_original_cap s src) (UntypedCap deva ra bitsa fa) True; untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> UntypedCap deva ra bitsa fa)); cap = UntypedCap deva ra bitsa fa\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) (caps_of_state s)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest \<mapsto> src)) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> (obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> (\<forall>a b. cdt s \<Turnstile> (a, b) \<rightarrow> src \<longrightarrow> (a, b) \<noteq> dest) \<and> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (9 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?c494 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (?c494 s capa) \<and> cap_range cap \<subseteq> cap_range (?c494 s capa)
 3. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_class cap = cap_class capa \<and> cap_range cap \<subseteq> cap_range capa
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src\<rbrakk> \<Longrightarrow> (a, b) \<noteq> dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; cdt s \<Turnstile> (a, b) \<rightarrow> src; (a, b) = dest\<rbrakk> \<Longrightarrow> False
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) (caps_of_state s)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?c506 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> cap_aligned (?c506 s capa)
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> caps_of_state s dest = Some NullCap
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_derived (cdt s) src cap (?c506 s capa)
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_untyped_cap (?c506 s capa) \<longrightarrow> usable_untyped_range (?c506 s capa) = {}
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> cap_aligned capa
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> caps_of_state s dest = Some NullCap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_derived (cdt s) src cap capa
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> usable_untyped_range capa = {}
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> caps_of_state s dest = Some NullCap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_derived (cdt s) src cap capa
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> usable_untyped_range capa = {}
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> usable_untyped_range capa = {}
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); untyped_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); reply_mdb ((cdt s)(dest \<mapsto> src)) ((caps_of_state s)(dest \<mapsto> cap)); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) \<and> untyped_inc ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := if should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa) then Some src else cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa)\<rbrakk> \<Longrightarrow> (is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap \<longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := cdt s src)) \<and> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))) \<and> ((obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap) \<longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> no_mloop ((cdt s)(dest := cdt s src)) \<and> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap)) \<and> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))) proof (prove)
goal (18 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 18 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa618 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x618 s capa) (?capa618 s capa))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 20 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (?cs619 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ?cs619 s capa src = Some (?c619 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ?cs619 s capa dest = Some NullCap
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_derived (cdt s) src (?cap619 s capa) (?c619 s capa)
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; untyped_mdb ((cdt s)(dest := cdt s src)) ((?cs619 s capa)(dest \<mapsto> ?cap619 s capa))\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa618 s capa)
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x618 s capa) (?capa618 s capa))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 24 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_range (the (caps_of_state s x))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(src \<mapsto> max_free_index_update capa)) x)) = cap_range (the (caps_of_state s x))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> src \<noteq> dest
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> ((caps_of_state s)(src \<mapsto> max_free_index_update capa)) src = Some (?c640 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (?c640 s capa) \<and> cap_range cap \<subseteq> cap_range (?c640 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; descendants_inc (cdt s) ((caps_of_state s)(src \<mapsto> max_free_index_update capa))\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (max_free_index_update capa) \<and> cap_range cap \<subseteq> cap_range (max_free_index_update capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel ((cdt s)(dest := cdt s src)))\<^sup>+
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> (dest, src) \<notin> (cdt_parent_rel (cdt s))\<^sup>+
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?cap658 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update (?cap658 s capa))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_aligned cap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> is_original_cap s src
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; s \<turnstile> capa\<rbrakk> \<Longrightarrow> cap_aligned cap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> is_original_cap s src
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
A total of 16 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((a, b) = src \<longrightarrow> max_free_index_update capa = IRQControlCap \<longrightarrow> is_original_cap s src) \<and> ((a, b) \<noteq> src \<longrightarrow> (a, b) = dest \<longrightarrow> cap \<noteq> IRQControlCap)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; (a, b) = src; max_free_index_update capa = IRQControlCap\<rbrakk> \<Longrightarrow> is_original_cap s src
 2. \<And>s capa a b. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (case cap of UntypedCap x xa xb xc \<Rightarrow> True | EndpointCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | NotificationCap x xa xb \<Rightarrow> cap_ep_badge cap \<noteq> cap_ep_badge capa | IRQHandlerCap x \<Rightarrow> capa = IRQControlCap | ArchObjectCap acap \<Rightarrow> arch_is_cap_revocable cap capa | _ \<Rightarrow> False); is_untyped_cap capa; is_untyped_cap cap; obj_ref_of capa = obj_ref_of cap; cap_bits_untyped capa = cap_bits_untyped cap; (a, b) \<noteq> src; (a, b) = dest\<rbrakk> \<Longrightarrow> cap \<noteq> IRQControlCap
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s dev f deva ra bitsa fa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> UntypedCap deva ra bitsa fa; valid_objs s; src \<noteq> dest; is_derived (cdt s) src (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f); caps_of_state s src = Some (UntypedCap dev ra bitsa f); caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of (UntypedCap dev ra bitsa f) (is_original_cap s src) (UntypedCap deva ra bitsa fa) (is_cap_revocable (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f)); cap = UntypedCap deva ra bitsa fa\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable (UntypedCap deva ra bitsa fa) (UntypedCap dev ra bitsa f))) ((caps_of_state s)(src \<mapsto> UntypedCap dev ra bitsa (max_free_index bitsa), dest \<mapsto> UntypedCap deva ra bitsa fa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa827 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x827 s capa) (?capa827 s capa))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_master_reply_cap capa \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap; reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa827 s capa)
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x827 s capa) (?capa827 s capa))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ((caps_of_state s)(dest \<mapsto> cap)) src = Some (?capa827 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap) = (caps_of_state s)(dest \<mapsto> cap, src \<mapsto> free_index_update (\<lambda>_. ?x827 s capa) (?capa827 s capa))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(src \<mapsto> max_free_index_update capa, dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); is_untyped_cap capa \<and> is_untyped_cap cap \<and> obj_ref_of capa = obj_ref_of cap \<and> cap_bits_untyped capa = cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap, src \<mapsto> max_free_index_update capa))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (9 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (13 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (?cs849 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ?cs849 s capa src = Some (?c849 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ?cs849 s capa dest = Some NullCap
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_derived (cdt s) src (?cap849 s capa) (?c849 s capa)
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; untyped_mdb ((cdt s)(dest := cdt s src)) ((?cs849 s capa)(dest \<mapsto> ?cap849 s capa))\<rbrakk> \<Longrightarrow> untyped_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 10. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
A total of 13 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> descendants_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (9 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> caps_of_state s src = Some (?c856 s capa)
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_class cap = cap_class (?c856 s capa) \<and> cap_range cap \<subseteq> cap_range (?c856 s capa)
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 9. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_class cap = cap_class capa \<and> cap_range cap \<subseteq> cap_range capa
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> no_mloop ((cdt s)(dest := cdt s src))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel ((cdt s)(dest := cdt s src)))\<^sup>+
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); \<forall>a b. ((a, b), a, b) \<notin> (cdt_parent_rel (cdt s))\<^sup>+; untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> (\<exists>a b. (a, b) = dest) \<longrightarrow> (dest, src) \<notin> (cdt_parent_rel (cdt s))\<^sup>+
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (8 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> cap_aligned cap
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> is_original_cap s src
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 8. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (7 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_untyped_cap capa \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 7. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (6 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> untyped_inc ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 6. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (5 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> ut_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 5. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (4 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> irq_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 4. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_master_revocable ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (3 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> is_master_reply_cap capa \<longrightarrow> is_original_cap s src
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 3. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (2 subgoals):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap; reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))\<rbrakk> \<Longrightarrow> reply_mdb ((cdt s)(dest := cdt s src)) ((caps_of_state s)(dest \<mapsto> cap))
 2. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal (1 subgoal):
 1. \<And>s capa. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); irq_revocable (is_original_cap s) (caps_of_state s); reply_master_revocable (is_original_cap s) (caps_of_state s); reply_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); s \<turnstile> cap; valid_objs s; src \<noteq> dest; is_derived (cdt s) src cap capa; caps_of_state s src = Some capa; caps_of_state s dest = Some NullCap; mdb_insert_abs (cdt s) src dest; mdb_insert_abs_sib (cdt s) src dest; \<not> should_be_parent_of capa (is_original_cap s src) cap (is_cap_revocable cap capa); obj_ref_of capa = obj_ref_of cap \<longrightarrow> is_untyped_cap cap \<longrightarrow> is_untyped_cap capa \<longrightarrow> cap_bits_untyped capa \<noteq> cap_bits_untyped cap\<rbrakk> \<Longrightarrow> valid_arch_mdb ((is_original_cap s)(dest := is_cap_revocable cap capa)) ((caps_of_state s)(dest \<mapsto> cap)) proof (prove)
goal:
No subgoals!