theory CSpace_R

lemma arch_update_setCTE_mdb:
  "\<lbrace>cte_wp_at' (is_arch_update' cap) p and cte_wp_at' ((=) oldcte) p and valid_mdb'\<rbrace>
  setCTE p (cteCap_update (\<lambda>_. cap) oldcte)
  \<lbrace>\<lambda>rv. valid_mdb'\<rbrace>" apply (simp add: valid_mdb'_def) apply wp apply (clarsimp simp: valid_mdb_ctes_def cte_wp_at_ctes_of simp del: fun_upd_apply) apply (rule conjI) apply (rule valid_dlistI) apply (fastforce split: if_split_asm elim: valid_dlistE) apply (fastforce split: if_split_asm elim: valid_dlistE) apply (rule conjI) apply (clarsimp simp: no_0_def) apply (rule conjI) apply (simp add: mdb_chain_0_def mdb_next_trans_next_pres) apply blast apply (rule conjI) apply (cases oldcte) apply (clarsimp simp: valid_badges_def mdb_next_pres simp del: fun_upd_apply) apply (clarsimp simp: is_arch_update'_def) apply (clarsimp split: if_split_asm) apply (clarsimp simp: isCap_simps) prefer 2 subgoal by fastforce apply (erule_tac x=pa in allE) apply (erule_tac x=p in allE) apply simp apply (simp add: sameRegionAs_def3) apply (rule conjI) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: isCap_simps) apply (rule conjI) apply (clarsimp simp: caps_contained'_def simp del: fun_upd_apply) apply (cases oldcte) apply (clarsimp simp: is_arch_update'_def) apply (frule capMaster_untypedRange) apply (frule capMaster_capRange) apply (drule sym [where s="capMasterCap cap"]) apply (frule masterCap.intro) apply (clarsimp simp: masterCap.isUntypedCap split: if_split_asm) subgoal by fastforce subgoal by fastforce apply (erule_tac x=pa in allE) apply (erule_tac x=p in allE) apply fastforce apply (erule_tac x=pa in allE) apply (erule_tac x=p' in allE) subgoal by fastforce apply (rule conjI) apply (cases oldcte) apply (clarsimp simp: is_arch_update'_def) apply (clarsimp simp: mdb_chunked_def mdb_next_trans_next_pres simp del: fun_upd_apply) apply (drule sym [where s="capMasterCap cap"]) apply (frule masterCap.intro) apply (clarsimp split: if_split_asm) apply (erule_tac x=p in allE) apply (erule_tac x=p' in allE) apply (clarsimp simp: masterCap.sameRegionAs) apply (simp add: masterCap.sameRegionAs is_chunk_def mdb_next_trans_next_pres
                      mdb_next_rtrans_next_pres) subgoal by fastforce apply (erule_tac x=pa in allE) apply (erule_tac x=p in allE) apply (clarsimp simp: masterCap.sameRegionAs) apply (simp add: masterCap.sameRegionAs is_chunk_def mdb_next_trans_next_pres
                     mdb_next_rtrans_next_pres) subgoal by fastforce apply (erule_tac x=pa in allE) apply (erule_tac x=p' in allE) apply clarsimp apply (simp add: masterCap.sameRegionAs is_chunk_def mdb_next_trans_next_pres
                    mdb_next_rtrans_next_pres) subgoal by fastforce apply (rule conjI) apply (clarsimp simp: is_arch_update'_def untyped_mdb'_def arch_update_descendants'
                   simp del: fun_upd_apply) apply (cases oldcte) apply clarsimp apply (clarsimp split: if_split_asm) apply (clarsimp simp: isCap_simps) apply (frule capMaster_isUntyped) apply (drule capMaster_capRange) apply simp apply (rule conjI) apply (clarsimp simp: untyped_inc'_def arch_update_descendants'
                   simp del: fun_upd_apply) apply (cases oldcte) apply (clarsimp simp: is_arch_update'_def) apply (drule capMaster_untypedRange) apply (clarsimp split: if_split_asm) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: isCap_simps) apply (erule_tac x=pa in allE) apply (erule_tac x=p' in allE) apply clarsimp apply (rule conjI) apply (cases oldcte) apply (clarsimp simp: valid_nullcaps_def is_arch_update'_def isCap_simps) apply (rule conjI) apply (cases oldcte) apply (clarsimp simp: ut_revocable'_def is_arch_update'_def isCap_simps) apply (rule conjI) apply (clarsimp simp: class_links_def simp del: fun_upd_apply) apply (cases oldcte) apply (clarsimp simp: is_arch_update'_def mdb_next_pres) apply (drule capMaster_capClass) apply (clarsimp split: if_split_asm) apply fastforce apply (rule conjI) apply (erule(1) distinct_zombies_sameMasterE) apply (clarsimp simp: is_arch_update'_def) apply (clarsimp simp: irq_control_def) apply (cases oldcte) apply (subgoal_tac "cap \<noteq> IRQControlCap") prefer 2 apply (clarsimp simp: is_arch_update'_def isCap_simps) apply (rule conjI) apply clarsimp apply (simp add: reply_masters_rvk_fb_def) apply (erule ball_ran_fun_updI) apply (clarsimp simp add: is_arch_update'_def isCap_simps) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>cte_wp_at' (is_arch_update' cap) p and cte_wp_at' ((=) oldcte) p and valid_mdb'\<rbrace> setCTE p (cteCap_update (\<lambda>_. cap) oldcte) \<lbrace>\<lambda>rv. valid_mdb'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>cte_wp_at' (is_arch_update' cap) p and cte_wp_at' ((=) oldcte) p and (\<lambda>s. valid_mdb_ctes (ctes_of s))\<rbrace> setCTE p (cteCap_update (\<lambda>_. cap) oldcte) \<lbrace>\<lambda>rv s. valid_mdb_ctes (ctes_of s)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. (cte_wp_at' (is_arch_update' cap) p and cte_wp_at' ((=) oldcte) p and (\<lambda>s. valid_mdb_ctes (ctes_of s))) s \<Longrightarrow> valid_mdb_ctes ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_dlist ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_dlist ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s pa cte. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some cte; mdbPrev (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) (mdbPrev (cteMDBNode cte)) = Some cte' \<and> mdbNext (cteMDBNode cte') = pa
 2. \<And>s pa cte. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = pa
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa cte. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some cte; mdbNext (cteMDBNode cte) \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>cte'. ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) (mdbNext (cteMDBNode cte)) = Some cte' \<and> mdbPrev (cteMDBNode cte') = pa
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chain_0 ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); \<forall>x\<in>dom (ctes_of s). ctes_of s \<turnstile> x \<leadsto>\<^sup>+ 0; valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ 0
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa node cap' node'. \<lbrakk>ctes_of s p = Some (CTE x1 x2); is_arch_update' cap (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; ((ctes_of s)(p \<mapsto> CTE cap x2)) pa = Some (CTE capa node); ((ctes_of s)(p \<mapsto> CTE cap x2)) p' = Some (CTE cap' node'); ctes_of s \<turnstile> pa \<leadsto> p'; global.sameRegionAs capa cap'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa node cap' node'. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE capa node); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE cap' node'); ctes_of s \<turnstile> pa \<leadsto> p'; global.sameRegionAs capa cap'; isArchObjectCap cap; capMasterCap cap = capMasterCap x1\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' node'. \<lbrakk>ctes_of s \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; p' \<noteq> p; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 3. \<And>s x1 x2 pa p' capa node cap' node'. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p'; global.sameRegionAs capa cap'; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); p' \<noteq> p; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s x1 x2 pa p' capa node cap' node'. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p'; global.sameRegionAs capa cap'; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); p' \<noteq> p; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa p' capa node cap' node'. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p'; global.sameRegionAs capa cap'; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); p' \<noteq> p; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s_ \<turnstile> pa_ \<leadsto> p'_; global.sameRegionAs capa_ cap'_; isArchObjectCap cap; capMasterCap cap = capMasterCap x1_; ctes_of s_ p = Some (CTE x1_ x2_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); \<forall>p p' cap. (\<exists>node. ctes_of s_ p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s_ p' = Some (CTE cap' node') \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); oldcte = CTE x1_ x2_; pa_ \<noteq> p; ctes_of s_ pa_ = Some (CTE capa_ node_); p'_ \<noteq> p; ctes_of s_ p'_ = Some (CTE cap'_ node'_)\<rbrakk> \<Longrightarrow> (isEndpointCap capa_ \<longrightarrow> capEPBadge capa_ \<noteq> capEPBadge cap'_ \<longrightarrow> capEPBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) \<and> (isNotificationCap capa_ \<longrightarrow> capNtfnBadge capa_ \<noteq> capNtfnBadge cap'_ \<longrightarrow> capNtfnBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); \<forall>p' cap. (\<exists>node. ctes_of s pa = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> pa \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); \<forall>cap. (\<exists>node. ctes_of s pa = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> pa \<leadsto> p \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; global.sameRegionAs capa cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); global.sameRegionAs capa x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> cap \<noteq> capability.NullCap \<and> \<not> isZombie cap \<and> \<not> isUntypedCap cap \<and> \<not> isArchPageCap cap \<or> capRange cap \<noteq> {} \<and> capRange cap \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap cap) \<or> isIRQControlCap capa \<and> isIRQHandlerCap cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); (capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> x1 \<noteq> capability.NullCap \<and> \<not> isZombie x1 \<and> \<not> isUntypedCap x1 \<and> \<not> isArchPageCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (capRange x1 \<noteq> {} \<and> capRange x1 \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap x1) \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (isIRQControlCap capa \<and> isIRQHandlerCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2))\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> cap \<noteq> capability.NullCap \<and> \<not> isZombie cap \<and> \<not> isUntypedCap cap \<and> \<not> isArchPageCap cap \<or> capRange cap \<noteq> {} \<and> capRange cap \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap cap) \<or> isIRQControlCap capa \<and> isIRQHandlerCap cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); (capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> x1 \<noteq> capability.NullCap \<and> \<not> isZombie x1 \<and> \<not> isUntypedCap x1 \<and> \<not> isArchPageCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (capRange x1 \<noteq> {} \<and> capRange x1 \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap x1) \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (isIRQControlCap capa \<and> isIRQHandlerCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2))\<rbrakk> \<Longrightarrow> isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2
 2. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> cap \<noteq> capability.NullCap \<and> \<not> isZombie cap \<and> \<not> isUntypedCap cap \<and> \<not> isArchPageCap cap \<or> capRange cap \<noteq> {} \<and> capRange cap \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap cap) \<or> isIRQControlCap capa \<and> isIRQHandlerCap cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); (capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> x1 \<noteq> capability.NullCap \<and> \<not> isZombie x1 \<and> \<not> isUntypedCap x1 \<and> \<not> isArchPageCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (capRange x1 \<noteq> {} \<and> capRange x1 \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap x1) \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (isIRQControlCap capa \<and> isIRQHandlerCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2))\<rbrakk> \<Longrightarrow> isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa capa node. \<lbrakk>ctes_of s \<turnstile> pa \<leadsto> p; capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> cap \<noteq> capability.NullCap \<and> \<not> isZombie cap \<and> \<not> isUntypedCap cap \<and> \<not> isArchPageCap cap \<or> capRange cap \<noteq> {} \<and> capRange cap \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap cap) \<or> isIRQControlCap capa \<and> isIRQHandlerCap cap; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; pa \<noteq> p; ctes_of s pa = Some (CTE capa node); (capMasterCap capa = capMasterCap x1 \<and> capa \<noteq> capability.NullCap \<and> \<not> isZombie capa \<and> \<not> isUntypedCap capa \<and> \<not> isArchPageCap capa \<and> x1 \<noteq> capability.NullCap \<and> \<not> isZombie x1 \<and> \<not> isUntypedCap x1 \<and> \<not> isArchPageCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (capRange x1 \<noteq> {} \<and> capRange x1 \<subseteq> capRange capa \<and> (isUntypedCap capa \<or> isArchPageCap capa \<and> isArchPageCap x1) \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)) \<and> (isIRQControlCap capa \<and> isIRQHandlerCap x1 \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge x1 \<longrightarrow> capEPBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge x1 \<longrightarrow> capNtfnBadge x1 \<noteq> 0 \<longrightarrow> mdbFirstBadged x2))\<rbrakk> \<Longrightarrow> isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; untypedRange cap = untypedRange x1\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; untypedRange cap = untypedRange x1; capRange cap = capRange x1\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (5 subgoals):
 1. \<And>s n x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange x1 \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> x \<in> untypedRange x1
 2. \<And>s p' n c' n' x x1. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange x1 \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 n; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange x1
 3. \<And>s pa c n n' x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange c \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 5. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> isUntypedCap x1_; capRange x1_ \<inter> untypedRange x1_ \<noteq> {}; x_ \<in> capRange x1_; oldcte = CTE x1_ n_; isArchObjectCap cap; untypedRange cap = untypedRange x1_; capRange cap = capRange x1_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ n_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); \<forall>p p' c. (\<exists>n. ctes_of s_ p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s_ p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_)\<rbrakk> \<Longrightarrow> x_ \<in> untypedRange x1_ proof (prove)
goal (4 subgoals):
 1. \<And>s p' n c' n' x x1. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange x1 \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 n; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange x1
 2. \<And>s pa c n n' x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange c \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> isUntypedCap c'_; capRange c'_ \<inter> untypedRange x1_ \<noteq> {}; x_ \<in> capRange c'_; oldcte = CTE x1_ n_; isArchObjectCap cap; untypedRange cap = untypedRange x1_; capRange cap = capRange x1_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ n_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); \<forall>p p' c. (\<exists>n. ctes_of s_ p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s_ p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); p'_ \<noteq> p; ctes_of s_ p'_ = Some (CTE c'_ n'_)\<rbrakk> \<Longrightarrow> x_ \<in> untypedRange x1_ proof (prove)
goal (3 subgoals):
 1. \<And>s pa c n n' x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange c \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s pa c n n' x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange c \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); \<forall>p' c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s pa c n n' x x1. \<lbrakk>\<not> isUntypedCap x1; capRange x1 \<inter> untypedRange c \<noteq> {}; x \<in> capRange x1; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); \<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); \<forall>p' c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x x1 x2. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; capRange cap = capRange x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); \<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<not> isUntypedCap c'_; capRange c'_ \<inter> untypedRange c_ \<noteq> {}; x_ \<in> capRange c'_; oldcte = CTE x1_ x2_; isArchObjectCap cap; untypedRange cap = untypedRange x1_; capRange cap = capRange x1_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ x2_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); pa_ \<noteq> p; ctes_of s_ pa_ = Some (CTE c_ n_); p'_ \<noteq> p; ctes_of s_ p'_ = Some (CTE c'_ n'_); \<forall>c. (\<exists>n. ctes_of s_ pa_ = Some (CTE c n)) \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s_ p'_ = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> capRange c' \<subseteq> untypedRange c)\<rbrakk> \<Longrightarrow> x_ \<in> untypedRange c_ proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(p \<mapsto> CTE cap x2))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1; ((ctes_of s)(p \<mapsto> CTE cap x2)) pa = Some (CTE capa n); ((ctes_of s)(p \<mapsto> CTE cap x2)) p' = Some (CTE cap' n'); global.sameRegionAs capa cap'; pa \<noteq> p'\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; ((ctes_of s)(p \<mapsto> CTE cap x2)) pa = Some (CTE capa n); ((ctes_of s)(p \<mapsto> CTE cap x2)) p' = Some (CTE cap' n'); global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; ((ctes_of s)(p \<mapsto> CTE cap x2)) pa = Some (CTE capa n); ((ctes_of s)(p \<mapsto> CTE cap x2)) p' = Some (CTE cap' n'); global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' n'. \<lbrakk>ctes_of s p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' p)
 2. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 3. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' n'. \<lbrakk>ctes_of s p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; \<forall>p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' p)
 2. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 3. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' n'. \<lbrakk>ctes_of s p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; \<forall>cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' p)
 2. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 3. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' n'. \<lbrakk>ctes_of s p' = Some (CTE cap' n'); global.sameRegionAs x1 cap'; p \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) x1 p p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' p)
 2. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 3. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' n'. \<lbrakk>ctes_of s p' = Some (CTE cap' n'); global.sameRegionAs x1 cap'; p \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs x1 cap'')); ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs x1 x1) \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> global.sameRegionAs cap' x1)
 2. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 3. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ctes_of s_ p'_ = Some (CTE cap'_ n'_); global.sameRegionAs x1_ cap'_; p \<noteq> p'_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ x2_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); caps_contained' (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); oldcte = CTE x1_ x2_; isArchObjectCap cap; ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p'_ \<or> ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p; ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p'_ \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* p'_ \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs x1_ cap'')); ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap'_ cap''))\<rbrakk> \<Longrightarrow> (ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p'_ \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>* p'_ \<longrightarrow> global.sameRegionAs x1_ x1_) \<and> (ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p \<longrightarrow> global.sameRegionAs cap'_ x1_) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n)\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 2. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); \<forall>p' cap. (\<exists>n. ctes_of s pa = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> pa \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) cap' p' pa))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 2. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa cap; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); \<forall>cap. (\<exists>n. ctes_of s pa = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> pa \<noteq> p \<longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) cap' p pa))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 2. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa; ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) capa pa p; ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) x1 p pa\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap p pa)
 2. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 pa capa n. \<lbrakk>global.sameRegionAs capa x1; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<or> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa; ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs capa cap'')); ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* pa \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs x1 cap''))\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ pa \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>* pa \<longrightarrow> global.sameRegionAs x1 x1
 2. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>global.sameRegionAs capa_ x1_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ x2_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); caps_contained' (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); oldcte = CTE x1_ x2_; isArchObjectCap cap; pa_ \<noteq> p; ctes_of s_ pa_ = Some (CTE capa_ n_); ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p \<or> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ pa_; ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* p \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs capa_ cap'')); ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ pa_ \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* pa_ \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs x1_ cap''))\<rbrakk> \<Longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ pa_ \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>* pa_ \<longrightarrow> global.sameRegionAs x1_ x1_ proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); \<forall>p p' cap. (\<exists>n. ctes_of s p = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> p \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (ctes_of s \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap p p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (ctes_of s) cap' p' p)); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n')\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n'); \<forall>p' cap. (\<exists>n. ctes_of s pa = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> pa \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) cap' p' pa))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n'); \<forall>cap. (\<exists>n. ctes_of s pa = Some (CTE cap n)) \<longrightarrow> (\<forall>cap'. (\<exists>n'. ctes_of s p' = Some (CTE cap' n')) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> pa \<noteq> p' \<longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa) \<and> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) cap pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) cap' p' pa))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n'); ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa; ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (ctes_of s) capa pa p'; ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk (ctes_of s) cap' p' pa\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) capa pa p') \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> is_chunk ((ctes_of s)(p \<mapsto> CTE cap x2)) cap' p' pa)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 pa p' capa n cap' n'. \<lbrakk>global.sameRegionAs capa cap'; pa \<noteq> p'; capMasterCap x1 = capMasterCap cap; masterCap x1 cap; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE capa n); p' \<noteq> p; ctes_of s p' = Some (CTE cap' n'); ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<or> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa; ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* p' \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs capa cap'')); ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> (\<forall>p''. ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s \<turnstile> p'' \<leadsto>\<^sup>* pa \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap' cap''))\<rbrakk> \<Longrightarrow> (ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p' \<longrightarrow> ctes_of s \<turnstile> pa \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>* p' \<longrightarrow> global.sameRegionAs capa x1) \<and> (ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ pa \<longrightarrow> ctes_of s \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s \<turnstile> p \<leadsto>\<^sup>* pa \<longrightarrow> global.sameRegionAs cap' x1)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>global.sameRegionAs capa_ cap'_; pa_ \<noteq> p'_; capMasterCap x1_ = capMasterCap cap; masterCap x1_ cap; ctes_of s_ p = Some (CTE x1_ x2_); valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); caps_contained' (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); oldcte = CTE x1_ x2_; isArchObjectCap cap; pa_ \<noteq> p; ctes_of s_ pa_ = Some (CTE capa_ n_); p'_ \<noteq> p; ctes_of s_ p'_ = Some (CTE cap'_ n'_); ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p'_ \<or> ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ pa_; ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p'_ \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* p'_ \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs capa_ cap'')); ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ pa_ \<longrightarrow> (\<forall>p''. ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p'' \<longrightarrow> ctes_of s_ \<turnstile> p'' \<leadsto>\<^sup>* pa_ \<longrightarrow> (\<exists>cap''. (\<exists>n''. ctes_of s_ p'' = Some (CTE cap'' n'')) \<and> global.sameRegionAs cap'_ cap''))\<rbrakk> \<Longrightarrow> (ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p'_ \<longrightarrow> ctes_of s_ \<turnstile> pa_ \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>* p'_ \<longrightarrow> global.sameRegionAs capa_ x1_) \<and> (ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ pa_ \<longrightarrow> ctes_of s_ \<turnstile> p'_ \<leadsto>\<^sup>+ p \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto>\<^sup>* pa_ \<longrightarrow> global.sameRegionAs cap'_ x1_) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_mdb' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n'. \<lbrakk>ctes_of s p = Some oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap (cteCap oldcte); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); isUntypedCap c; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>ctes_of s p = Some oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap (cteCap oldcte); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); isUntypedCap c; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap x1; (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); isUntypedCap c; (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s p' n c' n' x1. \<lbrakk>\<not> isUntypedCap c'; capRange c' \<inter> untypedRange cap \<noteq> {}; oldcte = CTE x1 n; ctes_of s p = Some (CTE x1 n); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap x1; isUntypedCap cap; p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (ctes_of s)
 2. \<And>s pa c n n' x1. \<lbrakk>\<not> isUntypedCap cap; capRange cap \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 n'; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap x1; pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c\<rbrakk> \<Longrightarrow> p \<in> descendants_of' pa (ctes_of s)
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa c n n' x1. \<lbrakk>\<not> isUntypedCap cap; capRange cap \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 n'; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap x1; pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c\<rbrakk> \<Longrightarrow> p \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa c n n' x1. \<lbrakk>\<not> isUntypedCap cap; capRange cap \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 n'; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; capMasterCap cap = capMasterCap x1; pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; isUntypedCap cap = isUntypedCap x1\<rbrakk> \<Longrightarrow> p \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa c n n' x1. \<lbrakk>\<not> isUntypedCap cap; capRange cap \<inter> untypedRange c \<noteq> {}; oldcte = CTE x1 n'; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> \<not> isUntypedCap c' \<longrightarrow> capRange c' \<inter> untypedRange c \<noteq> {} \<longrightarrow> p' \<in> descendants_of' p (ctes_of s)); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isArchObjectCap cap; pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; isUntypedCap cap = isUntypedCap x1; capRange cap = capRange x1\<rbrakk> \<Longrightarrow> p \<in> descendants_of' pa (ctes_of s)
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> untyped_inc' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n'. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); isUntypedCap c; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some (CTE c n); isUntypedCap c; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some (CTE c' n'); isUntypedCap c'; oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); isUntypedCap c; (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some (CTE c n); isUntypedCap c; (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some (CTE c' n'); isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (4 subgoals):
 1. \<And>s p' n c' n' x1. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 n; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 n); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); isUntypedCap cap; p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> (untypedRange x1 \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange x1 \<or> untypedRange x1 \<inter> untypedRange c' = {}) \<and> (untypedRange x1 \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange x1 \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange x1 \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange cap = {}) \<and> (untypedRange x1 = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {})
 2. \<And>s pa c n n' x1. \<lbrakk>isUntypedCap cap; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange x1 \<or> untypedRange x1 \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange x1 = {}) \<and> (untypedRange c \<subset> untypedRange x1 \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange x1 \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange x1 \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange x1 \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {})
 3. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {})
 4. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (3 subgoals):
 1. \<And>s pa c n n' x1. \<lbrakk>isUntypedCap cap; oldcte = CTE x1 n'; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 n'); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange x1 \<or> untypedRange x1 \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange x1 = {}) \<and> (untypedRange c \<subset> untypedRange x1 \<longrightarrow> pa \<in> descendants_of' p (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange cap = {}) \<and> (untypedRange x1 \<subset> untypedRange c \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> untypedRange x1 \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange x1 \<longrightarrow> p \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange cap = {})
 2. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {})
 3. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); \<forall>p p' c. (\<exists>n. ctes_of s p = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (ctes_of s) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> p = p')); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; p' \<noteq> p; ctes_of s p' = Some (CTE c' n')\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {})
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); \<forall>p' c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {})
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' c n c' n' x1 x2. \<lbrakk>isUntypedCap c'; oldcte = CTE x1 x2; isArchObjectCap cap; untypedRange cap = untypedRange x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); pa \<noteq> p; ctes_of s pa = Some (CTE c n); isUntypedCap c; p' \<noteq> p; ctes_of s p' = Some (CTE c' n'); \<forall>c. (\<exists>n. ctes_of s pa = Some (CTE c n)) \<longrightarrow> isUntypedCap c \<longrightarrow> (\<forall>c'. (\<exists>n'. ctes_of s p' = Some (CTE c' n')) \<longrightarrow> isUntypedCap c' \<longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> pa \<in> descendants_of' p' (ctes_of s) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' pa (ctes_of s) \<and> usableUntypedRange c = {} \<or> pa \<in> descendants_of' p' (ctes_of s) \<and> usableUntypedRange c' = {} \<or> pa = p'))\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> untypedRange c' \<inter> usableUntypedRange c = {})
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> class_links ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' cte cte'. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); \<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some cte; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some cte'; (ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte) \<turnstile> pa \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' cte cte' x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); \<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) pa = Some cte; ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) p' = Some cte'; (ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte) \<turnstile> pa \<leadsto> p'; oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' cte cte' x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); \<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some cte; (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some cte'; ctes_of s \<turnstile> pa \<leadsto> p'; oldcte = CTE x1 x2; isArchObjectCap cap; capMasterCap cap = capMasterCap x1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s pa p' cte cte' x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); \<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); (if pa = p then Some (CTE cap x2) else ctes_of s pa) = Some cte; (if p' = p then Some (CTE cap x2) else ctes_of s p') = Some cte'; ctes_of s \<turnstile> pa \<leadsto> p'; oldcte = CTE x1 x2; isArchObjectCap cap; capClass cap = capClass x1\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s p' cte' x1 x2. \<lbrakk>ctes_of s \<turnstile> p \<leadsto> p'; oldcte = CTE x1 x2; isArchObjectCap cap; capClass cap = capClass x1; ctes_of s p = Some (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); \<forall>p p' cte. ctes_of s p = Some cte \<longrightarrow> (\<forall>cte'. ctes_of s p' = Some cte' \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p' \<noteq> p; ctes_of s p' = Some cte'\<rbrakk> \<Longrightarrow> capClass x1 = capClass (cteCap cte')
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); capClass (cteCap (cteCap_update (\<lambda>_. cap) oldcte)) = PhysicalClass\<rbrakk> \<Longrightarrow> capMasterCap (cteCap oldcte) = capMasterCap (cteCap (cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (\<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> (\<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> (\<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte))
 2. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> cap \<noteq> capability.IRQControlCap proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2\<rbrakk> \<Longrightarrow> cap \<noteq> capability.IRQControlCap
 2. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> (\<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> (\<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))) \<and> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> \<forall>pa. (pa = p \<longrightarrow> (\<forall>n. cteCap_update (\<lambda>_. cap) oldcte = CTE capability.IRQControlCap n \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. p' \<noteq> p \<longrightarrow> (\<forall>n'. ctes_of s p' \<noteq> Some (CTE capability.IRQControlCap n'))))) \<and> (pa \<noteq> p \<longrightarrow> (\<exists>n. ctes_of s pa = Some (CTE capability.IRQControlCap n)) \<longrightarrow> (\<forall>p'. (p' = p \<longrightarrow> (\<forall>n'. cteCap_update (\<lambda>_. cap) oldcte \<noteq> CTE capability.IRQControlCap n')) \<and> (p' \<noteq> p \<longrightarrow> (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = pa)))
 2. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some oldcte; is_arch_update' cap oldcte; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); reply_masters_rvk_fb (ctes_of s); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(p \<mapsto> cteCap_update (\<lambda>_. cap) oldcte)) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); is_arch_update' cap (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); \<forall>cte\<in>ran (ctes_of s). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> \<forall>cte\<in>ran ((ctes_of s)(p \<mapsto> CTE cap x2)). isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>ctes_of s p = Some (CTE x1 x2); is_arch_update' cap (CTE x1 x2); valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); \<forall>p n. ctes_of s p = Some (CTE capability.IRQControlCap n) \<longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. ctes_of s p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p); oldcte = CTE x1 x2; cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> \<forall>cte. Some (CTE cap x2) = Some cte \<longrightarrow> isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal:
No subgoals!