theory Syscall_AI

lemma decode_inv_wf[wp]:
  "\<lbrace>valid_cap cap and invs and cte_wp_at ((=) cap) slot
           and real_cte_at slot
           and ex_cte_cap_to slot
           and (\<lambda>s::'state_ext state. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s)
           and (\<lambda>s. \<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_to r s)
           and (\<lambda>s. \<forall>cap \<in> set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_to r s)
           and (\<lambda>s. \<forall>x \<in> set excaps. s \<turnstile> (fst x))
           and (\<lambda>s. \<forall>x \<in> set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s)
           and (\<lambda>s. \<forall>x \<in> set excaps. cte_wp_at ((=) (fst x)) (snd x) s)
           and (\<lambda>s. \<forall>x \<in> set excaps. real_cte_at (snd x) s)
           and (\<lambda>s. \<forall>x \<in> set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s)
           and (\<lambda>s. \<forall>x \<in> set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s)\<rbrace>
     decode_invocation label args cap_index slot cap excaps
   \<lbrace>valid_invocation\<rbrace>,-" apply (simp add: decode_invocation_def cong: cap.case_cong if_cong split del: if_split) apply (rule hoare_pre) apply (wp Tcb_AI.decode_tcb_inv_wf decode_domain_inv_wf[simplified split_def] | wpc |
          simp add: o_def uncurry_def split_def del: is_cnode_cap.simps cte_refs.simps)+ apply (strengthen cnode_eq_strg) apply (clarsimp simp: valid_cap_def cte_wp_at_eq_simp is_cap_simps
                        cap_rights_update_def ex_cte_cap_wp_to_weakenE[OF _ TrueI]
                        cte_wp_at_caps_of_state
                 split: cap.splits option.splits) apply (thin_tac " \<forall>x\<in>set excaps. P x \<and> Q x" for P Q)+ apply (drule (1) bspec)+ apply (subst split_paired_Ex[symmetric], rule exI, simp) apply (thin_tac " \<forall>x\<in>set excaps. P x \<and> Q x" for P Q)+ apply (rule conjI) apply (subst split_paired_Ex[symmetric], rule_tac x=slot in exI, simp) apply clarsimp apply (drule (1) bspec)+ apply (subst split_paired_Ex[symmetric], rule exI, simp) apply (thin_tac " \<forall>x\<in>set excaps. P x \<and> Q x" for P Q)+ apply (drule (1) bspec)+ apply (clarsimp simp add: ex_cte_cap_wp_to_weakenE[OF _ TrueI]) apply (rule eq_no_cap_to_obj_with_diff_ref) apply (fastforce simp add: cte_wp_at_caps_of_state) apply (simp add: invs_valid_arch_caps) apply (simp add: invs_valid_objs invs_valid_global_refs) apply (thin_tac " \<forall>x\<in>set excaps. P x \<and> Q x" for P Q)+ apply (drule (1) bspec)+ apply (subst split_paired_Ex[symmetric], rule exI, simp) apply (thin_tac " \<forall>x\<in>set excaps. P x \<and> Q x" for P Q)+ apply (subst split_paired_Ex[symmetric], rule exI, simp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_cap cap and invs and cte_wp_at ((=) cap) slot and real_cte_at slot and ex_cte_cap_wp_to (\<lambda>_. True) slot and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. \<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. real_cte_at (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s)\<rbrace> decode_invocation label args cap_index slot cap excaps \<lbrace>valid_invocation\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_cap cap and invs and cte_wp_at ((=) cap) slot and real_cte_at slot and ex_cte_cap_wp_to (\<lambda>_. True) slot and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. \<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. real_cte_at (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s)\<rbrace> case cap of UntypedCap dev ptr sz fi \<Rightarrow> liftME InvokeUntyped (decode_untyped_invocation label args slot (UntypedCap dev ptr sz fi) (map fst excaps)) | EndpointCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk (InvokeEndpoint ptr badge (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) else throwError (InvalidCapability 0) | NotificationCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk (InvokeNotification ptr badge) else throwError (InvalidCapability 0) | ReplyCap thread True rights \<Rightarrow> throwError $ InvalidCapability 0 | ReplyCap thread False rights \<Rightarrow> returnOk $ InvokeReply thread slot (AllowGrant \<in> rights) | CNodeCap ptr bits x \<Rightarrow> liftME InvokeCNode (decode_cnode_invocation label args (CNodeCap ptr bits x) (map fst excaps)) | ThreadCap ptr \<Rightarrow> liftME InvokeTCB (decode_tcb_invocation label args (ThreadCap ptr) slot excaps) | DomainCap \<Rightarrow> liftME (\<lambda>(x, y). InvokeDomain x y) (decode_domain_invocation label args excaps) | IRQControlCap \<Rightarrow> liftME InvokeIRQControl (decode_irq_control_invocation label args slot (map fst excaps)) | IRQHandlerCap irq \<Rightarrow> liftME InvokeIRQHandler (decode_irq_handler_invocation label irq excaps) | ArchObjectCap arch_cap \<Rightarrow> liftME InvokeArchObject (arch_decode_invocation label args cap_index slot arch_cap excaps) | _ \<Rightarrow> throwError (InvalidCapability 0) \<lbrace>valid_invocation\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'15\<rbrace> case cap of UntypedCap dev ptr sz fi \<Rightarrow> liftME InvokeUntyped (decode_untyped_invocation label args slot (UntypedCap dev ptr sz fi) (map fst excaps)) | EndpointCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk (InvokeEndpoint ptr badge (AllowGrant \<in> rights) (AllowGrantReply \<in> rights)) else throwError (InvalidCapability 0) | NotificationCap ptr badge rights \<Rightarrow> if AllowSend \<in> rights then returnOk (InvokeNotification ptr badge) else throwError (InvalidCapability 0) | ReplyCap thread True rights \<Rightarrow> throwError $ InvalidCapability 0 | ReplyCap thread False rights \<Rightarrow> returnOk $ InvokeReply thread slot (AllowGrant \<in> rights) | CNodeCap ptr bits x \<Rightarrow> liftME InvokeCNode (decode_cnode_invocation label args (CNodeCap ptr bits x) (map fst excaps)) | ThreadCap ptr \<Rightarrow> liftME InvokeTCB (decode_tcb_invocation label args (ThreadCap ptr) slot excaps) | DomainCap \<Rightarrow> liftME (\<lambda>(x, y). InvokeDomain x y) (decode_domain_invocation label args excaps) | IRQControlCap \<Rightarrow> liftME InvokeIRQControl (decode_irq_control_invocation label args slot (map fst excaps)) | IRQHandlerCap irq \<Rightarrow> liftME InvokeIRQHandler (decode_irq_handler_invocation label irq excaps) | ArchObjectCap arch_cap \<Rightarrow> liftME InvokeArchObject (arch_decode_invocation label args cap_index slot arch_cap excaps) | _ \<Rightarrow> throwError (InvalidCapability 0) \<lbrace>valid_invocation\<rbrace>, -
 2. \<And>s. (valid_cap cap and invs and cte_wp_at ((=) cap) slot and real_cte_at slot and ex_cte_cap_wp_to (\<lambda>_. True) slot and (\<lambda>s. \<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) and (\<lambda>s. \<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) and (\<lambda>s. \<forall>x\<in>set excaps. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. real_cte_at (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s) and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s)) s \<Longrightarrow> ?P'15 s proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<turnstile> cap \<and> invs s \<and> cte_wp_at ((=) cap) slot s \<and> real_cte_at slot s \<and> ex_cte_cap_wp_to (\<lambda>_. True) slot s \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set excaps. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s) \<and> (\<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s) \<and> (\<forall>x\<in>set excaps. real_cte_at (snd x) s) \<and> (\<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s) \<and> (\<forall>x\<in>set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s) \<Longrightarrow> (\<forall>x xa xb xc. cap = UntypedCap x xa xb xc \<longrightarrow> cte_wp_at ((=) (UntypedCap x xa xb xc)) slot s \<and> (\<forall>cap\<in>set excaps. is_cnode_cap (fst cap) \<longrightarrow> (\<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) \<and> (\<forall>x xa xb. cap = EndpointCap x xa xb \<longrightarrow> AllowSend \<in> xb \<longrightarrow> ep_at x s) \<and> (\<forall>x xa xb. cap = NotificationCap x xa xb \<longrightarrow> AllowSend \<in> xb \<longrightarrow> ntfn_at x s) \<and> (\<forall>x xa. (\<exists>xb. cap = ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> tcb_at x s \<and> cte_wp_at (\<lambda>cap. \<exists>R. cap = ReplyCap x False R) slot s) \<and> (\<forall>x xa xb. cap = CNodeCap x xa xb \<longrightarrow> s \<turnstile> CNodeCap x xa xb \<and> (is_cnode_cap (CNodeCap x xa xb) \<longrightarrow> (\<forall>r\<in>cte_refs (CNodeCap x xa xb) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> (\<forall>cap\<in>set excaps. is_cnode_cap (fst cap) \<longrightarrow> (\<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))) \<and> (\<forall>x. cap = ThreadCap x \<longrightarrow> tcb_at x s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>set excaps. ex_cte_cap_wp_to (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s)) \<and> (cap = DomainCap \<longrightarrow> valid_objs s \<and> valid_global_refs s) \<and> (cap = IRQControlCap \<longrightarrow> (\<forall>cap\<in>set excaps. is_cnode_cap (fst cap) \<longrightarrow> (\<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) \<and> cte_wp_at ((=) IRQControlCap) slot s) \<and> (\<forall>x. cap = IRQHandlerCap x \<longrightarrow> (\<exists>a b. cte_wp_at ((=) (IRQHandlerCap x)) (a, b) s)) \<and> (\<forall>x. cap = ArchObjectCap x \<longrightarrow> s \<turnstile> ArchObjectCap x \<and> cte_wp_at ((=) (ArchObjectCap x)) slot s) proof (prove)
goal (1 subgoal):
 1. \<And>s. s \<turnstile> cap \<and> invs s \<and> cte_wp_at ((=) cap) slot s \<and> real_cte_at slot s \<and> ex_cte_cap_wp_to (\<lambda>_. True) slot s \<and> (\<forall>r\<in>zobj_refs cap. ex_nonz_cap_to r s) \<and> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) \<and> (\<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s) \<and> (\<forall>x\<in>set excaps. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s) \<and> (\<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s) \<and> (\<forall>x\<in>set excaps. real_cte_at (snd x) s) \<and> (\<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s) \<and> (\<forall>x\<in>set excaps. cte_wp_at (interrupt_derived (fst x)) (snd x) s) \<Longrightarrow> (\<forall>x xa xb xc. cap = UntypedCap x xa xb xc \<longrightarrow> cte_wp_at ((=) (UntypedCap x xa xb xc)) slot s \<and> (\<forall>x\<in>set excaps. \<exists>ptr. cte_wp_at ((=) (fst x)) ptr s)) \<and> (\<forall>x xa xb. cap = EndpointCap x xa xb \<longrightarrow> AllowSend \<in> xb \<longrightarrow> ep_at x s) \<and> (\<forall>x xa xb. cap = NotificationCap x xa xb \<longrightarrow> AllowSend \<in> xb \<longrightarrow> ntfn_at x s) \<and> (\<forall>x xa. (\<exists>xb. cap = ReplyCap x xa xb) \<longrightarrow> \<not> xa \<longrightarrow> tcb_at x s \<and> cte_wp_at (\<lambda>cap. \<exists>R. cap = ReplyCap x False R) slot s) \<and> (\<forall>x xa xb. cap = CNodeCap x xa xb \<longrightarrow> s \<turnstile> CNodeCap x xa xb \<and> (\<exists>ptr. cte_wp_at ((=) (CNodeCap x xa xb)) ptr s) \<and> (\<forall>x\<in>set excaps. \<exists>ptr. cte_wp_at ((=) (fst x)) ptr s)) \<and> (\<forall>x. cap = ThreadCap x \<longrightarrow> tcb_at x s \<and> cte_wp_at (\<lambda>_. True) slot s \<and> (\<forall>x\<in>set excaps. ex_cte_cap_wp_to (\<lambda>_. True) (snd x) s \<and> no_cap_to_obj_dr_emp (fst x) s)) \<and> (cap = DomainCap \<longrightarrow> valid_objs s \<and> valid_global_refs s) \<and> (cap = IRQControlCap \<longrightarrow> (\<forall>x\<in>set excaps. \<exists>ptr. cte_wp_at ((=) (fst x)) ptr s) \<and> cte_wp_at ((=) IRQControlCap) slot s) \<and> (\<forall>x. cap = IRQHandlerCap x \<longrightarrow> (\<exists>a b. cte_wp_at ((=) (IRQHandlerCap x)) (a, b) s)) \<and> (\<forall>x. cap = ArchObjectCap x \<longrightarrow> s \<turnstile> ArchObjectCap x \<and> cte_wp_at ((=) (ArchObjectCap x)) slot s) proof (prove)
goal (6 subgoals):
 1. \<And>s x21 x22 x23 x24 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = UntypedCap x21 x22 x23 x24; cap_aligned (UntypedCap x21 x22 x23 x24); valid_untyped (UntypedCap x21 x22 x23 x24) s; untyped_min_bits \<le> x23; x24 \<le> 2 ^ x23; x22 \<noteq> 0; invs s; caps_of_state s slot = Some (UntypedCap x21 x22 x23 x24); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)) \<and> (\<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x))
 3. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 4. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 5. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 6. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (6 subgoals):
 1. \<And>s x21 x22 x23 x24 a aa b. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = UntypedCap x21 x22 x23 x24; cap_aligned (UntypedCap x21 x22 x23 x24); valid_untyped (UntypedCap x21 x22 x23 x24) s; untyped_min_bits \<le> x23; x24 \<le> 2 ^ x23; x22 \<noteq> 0; invs s; caps_of_state s slot = Some (UntypedCap x21 x22 x23 x24); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)) \<and> (\<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x))
 3. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 4. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 5. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 6. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (6 subgoals):
 1. \<And>s x21 x22 x23 x24 a aa b. \<lbrakk>cap = UntypedCap x21 x22 x23 x24; cap_aligned (UntypedCap x21 x22 x23 x24); valid_untyped (UntypedCap x21 x22 x23 x24) s; untyped_min_bits \<le> x23; x24 \<le> 2 ^ x23; x22 \<noteq> 0; invs s; caps_of_state s slot = Some (UntypedCap x21 x22 x23 x24); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs (fst (a, aa, b)). ex_nonz_cap_to r s; caps_of_state s (snd (a, aa, b)) = Some (fst (a, aa, b)); real_cte_at (snd (a, aa, b)) s; ex_cte_cap_wp_to is_cnode_cap (snd (a, aa, b)) s; interrupt_derived (fst (a, aa, b)) (fst (a, aa, b)); \<forall>r\<in>cte_refs (fst (a, aa, b)) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)) \<and> (\<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x))
 3. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 4. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 5. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 6. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)) \<and> (\<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x))
 2. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)) \<and> (\<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x))
 2. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (6 subgoals):
 1. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (CNodeCap x61 x62 x63)
 2. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x)
 3. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 4. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 5. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 6. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x61 x62 x63. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<forall>x\<in>set excaps. \<exists>a b. caps_of_state s (a, b) = Some (fst x)
 2. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x61 x62 x63 a aa b. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x61 x62 x63 a aa b. \<lbrakk>cap = CNodeCap x61 x62 x63; cap_aligned (CNodeCap x61 x62 x63); cap_table_at x62 x61 s; 0 < x62; length x63 \<le> word_bits; invs s; caps_of_state s slot = Some (CNodeCap x61 x62 x63); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x61 s; \<forall>y. length y = x62 \<longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (x61, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs (fst (a, aa, b)). ex_nonz_cap_to r s; caps_of_state s (snd (a, aa, b)) = Some (fst (a, aa, b)); real_cte_at (snd (a, aa, b)) s; ex_cte_cap_wp_to is_cnode_cap (snd (a, aa, b)) s; interrupt_derived (fst (a, aa, b)) (fst (a, aa, b)); \<forall>r\<in>cte_refs (fst (a, aa, b)) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (4 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 2. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 3. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 4. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (4 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 2. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 3. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 4. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (4 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs (fst (a, aa, b)). ex_nonz_cap_to r s; caps_of_state s (snd (a, aa, b)) = Some (fst (a, aa, b)); real_cte_at (snd (a, aa, b)) s; ex_cte_cap_wp_to is_cnode_cap (snd (a, aa, b)) s; interrupt_derived (fst (a, aa, b)) (fst (a, aa, b)); \<forall>r\<in>cte_refs (fst (a, aa, b)) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to (\<lambda>_. True) (aa, b) s \<and> no_cap_to_obj_dr_emp a s
 2. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 3. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 4. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (4 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs a. ex_nonz_cap_to r s; caps_of_state s (aa, b) = Some a; cap_table_at (length b) aa s; ex_cte_cap_wp_to is_cnode_cap (aa, b) s; interrupt_derived a a; \<forall>r\<in>cte_refs a (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> no_cap_to_obj_dr_emp a s
 2. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 3. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 4. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (5 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs a. ex_nonz_cap_to r s; caps_of_state s (aa, b) = Some a; cap_table_at (length b) aa s; ex_cte_cap_wp_to is_cnode_cap (aa, b) s; interrupt_derived a a; \<forall>r\<in>cte_refs a (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> cte_wp_at ((=) a) (?p633 s x7 a aa b) s
 2. \<And>s x7 a aa b. \<lbrakk>cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs a. ex_nonz_cap_to r s; caps_of_state s (aa, b) = Some a; cap_table_at (length b) aa s; ex_cte_cap_wp_to is_cnode_cap (aa, b) s; interrupt_derived a a; \<forall>r\<in>cte_refs a (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_arch_caps s
 3. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 4. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 5. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (4 subgoals):
 1. \<And>s x7 a aa b. \<lbrakk>cap = ThreadCap x7; cap_aligned (ThreadCap x7); tcb_at x7 s; invs s; caps_of_state s slot = Some (ThreadCap x7); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_nonz_cap_to x7 s; \<forall>y\<in>dom tcb_cap_cases. ex_cte_cap_wp_to (\<lambda>_. True) (x7, y) s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs a. ex_nonz_cap_to r s; caps_of_state s (aa, b) = Some a; cap_table_at (length b) aa s; ex_cte_cap_wp_to is_cnode_cap (aa, b) s; interrupt_derived a a; \<forall>r\<in>cte_refs a (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_arch_caps s
 2. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 3. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 4. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = DomainCap; cap_aligned DomainCap; invs s; caps_of_state s slot = Some DomainCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> valid_objs s \<and> valid_global_refs s
 2. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 3. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (2 subgoals):
 1. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (2 subgoals):
 1. \<And>s a aa b. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s; (a, aa, b) \<in> set excaps\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (2 subgoals):
 1. \<And>s a aa b. \<lbrakk>cap = IRQControlCap; cap_aligned IRQControlCap; invs s; caps_of_state s slot = Some IRQControlCap; real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; (a, aa, b) \<in> set excaps; \<forall>r\<in>zobj_refs (fst (a, aa, b)). ex_nonz_cap_to r s; caps_of_state s (snd (a, aa, b)) = Some (fst (a, aa, b)); real_cte_at (snd (a, aa, b)) s; ex_cte_cap_wp_to is_cnode_cap (snd (a, aa, b)) s; interrupt_derived (fst (a, aa, b)) (fst (a, aa, b)); \<forall>r\<in>cte_refs (fst (a, aa, b)) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>aa b. caps_of_state s (aa, b) = Some a
 2. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (1 subgoal):
 1. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. (\<forall>x21 x22 x23 x24. fst x = UntypedCap x21 x22 x23 x24 \<longrightarrow> x24 \<le> 2 ^ x23 \<and> untyped_min_bits \<le> x23 \<and> valid_untyped (UntypedCap x21 x22 x23 x24) s \<and> cap_aligned (UntypedCap x21 x22 x23 x24) \<and> x22 \<noteq> 0) \<and> (\<forall>x31. (\<forall>x32 x33. fst x \<noteq> EndpointCap x31 x32 x33) \<or> cap_aligned (fst x) \<and> ep_at x31 s) \<and> (\<forall>x41 x42 x43. fst x = NotificationCap x41 x42 x43 \<longrightarrow> ntfn_at x41 s \<and> cap_aligned (NotificationCap x41 x42 x43) \<and> AllowGrant \<notin> x43 \<and> AllowGrantReply \<notin> x43) \<and> (\<forall>x51 x52 x53. fst x = ReplyCap x51 x52 x53 \<longrightarrow> AllowWrite \<in> x53 \<and> tcb_at x51 s \<and> cap_aligned (ReplyCap x51 x52 x53) \<and> AllowRead \<notin> x53 \<and> AllowGrantReply \<notin> x53) \<and> (\<forall>x61 x62 x63. fst x = CNodeCap x61 x62 x63 \<longrightarrow> cap_table_at x62 x61 s \<and> cap_aligned (CNodeCap x61 x62 x63) \<and> 0 < x62 \<and> length x63 \<le> word_bits) \<and> (\<forall>x7. fst x = ThreadCap x7 \<longrightarrow> cap_aligned (ThreadCap x7) \<and> tcb_at x7 s) \<and> (fst x = DomainCap \<longrightarrow> cap_aligned DomainCap) \<and> (fst x = IRQControlCap \<longrightarrow> cap_aligned IRQControlCap) \<and> (\<forall>x10. fst x = IRQHandlerCap x10 \<longrightarrow> cap_aligned (IRQHandlerCap x10) \<and> x10 \<le> maxIRQ) \<and> (\<forall>x111 x112 x113. (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<exists>y. x112 = Some y) \<or> tcb_at x111 s \<and> cap_aligned (Zombie x111 x112 x113) \<and> x113 \<le> 5) \<and> (fst x = Zombie x111 x112 x113 \<longrightarrow> (\<forall>x2. x112 = Some x2 \<longrightarrow> x113 \<le> 2 ^ x2 \<and> cap_table_at x2 x111 s \<and> cap_aligned (Zombie x111 (Some x2) x113) \<and> 0 < x2))) \<and> (\<forall>x12. fst x = ArchObjectCap x12 \<longrightarrow> cap_aligned (ArchObjectCap x12) \<and> valid_arch_cap x12 s); \<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal (1 subgoal):
 1. \<And>s x10. \<lbrakk>\<forall>x\<in>set excaps. \<forall>r\<in>zobj_refs (fst x). ex_nonz_cap_to r s; \<forall>x\<in>set excaps. caps_of_state s (snd x) = Some (fst x); \<forall>x\<in>set excaps. real_cte_at (snd x) s; \<forall>x\<in>set excaps. ex_cte_cap_wp_to is_cnode_cap (snd x) s; \<forall>x\<in>set excaps. interrupt_derived (fst x) (fst x); cap = IRQHandlerCap x10; cap_aligned (IRQHandlerCap x10); x10 \<le> maxIRQ; invs s; caps_of_state s slot = Some (IRQHandlerCap x10); real_cte_at slot s; ex_cte_cap_wp_to (\<lambda>_. True) slot s; ex_cte_cap_wp_to (\<lambda>_. True) (interrupt_irq_node s x10, []) s; \<forall>cap\<in>set excaps. \<forall>r\<in>cte_refs (fst cap) (interrupt_irq_node s). ex_cte_cap_wp_to (\<lambda>_. True) r s\<rbrakk> \<Longrightarrow> \<exists>a b. caps_of_state s (a, b) = Some (IRQHandlerCap x10) proof (prove)
goal:
No subgoals!