theory Untyped_AI

lemma set_cap_valid_mdb_simple:
  "\<lbrace>\<lambda>s. valid_objs s \<and> valid_mdb s \<and> descendants_range_in {ptr .. ptr+2^sz - 1} cref s
   \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s\<rbrace>
  set_cap (UntypedCap dev ptr sz idx) cref
 \<lbrace>\<lambda>rv s'. valid_mdb s'\<rbrace>" apply (simp add: valid_mdb_def) apply (rule hoare_pre) apply (wp set_cap_mdb_cte_at) apply (wps set_cap_rvk_cdt_ct_ms) apply wp apply (clarsimp simp: cte_wp_at_caps_of_state is_cap_simps
    reply_master_revocable_def irq_revocable_def reply_mdb_def) unfolding fun_upd_def[symmetric] apply clarsimp proof(intro conjI impI) fix s f r bits dev assume obj:"valid_objs s" assume mdb:"untyped_mdb (cdt s) (caps_of_state s)" assume cstate:"caps_of_state s cref = Some (UntypedCap dev r bits f)" (is "?m cref = Some ?srccap") show "untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply (rule untyped_mdb_update_free_index
     [where capa = ?srccap and m = "caps_of_state s" and src = cref,
       unfolded free_index_update_def,simplified,THEN iffD2]) apply (simp add: cstate mdb)+ done assume inc: "untyped_inc (cdt s) (caps_of_state s)" assume drange: "descendants_range_in {r..r + 2 ^ bits - 1} cref s" have untyped_range_simp: "untyped_range (UntypedCap dev r bits f) = untyped_range (UntypedCap dev r bits idx)" by simp note blah[simp del] = untyped_range.simps usable_untyped_range.simps atLeastAtMost_iff atLeastatMost_subset_iff atLeastLessThan_iff
          Int_atLeastAtMost atLeastatMost_empty_iff split_paired_Ex show "untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using inc cstate drange apply (unfold untyped_inc_def) apply (intro allI impI) apply (drule_tac x = p in spec) apply (drule_tac x = p' in spec) apply (case_tac "p = cref") apply (simp) apply (case_tac "p' = cref") apply simp apply (simp add: untyped_range_simp) apply (intro conjI impI) apply (simp) apply (elim conjE) apply (thin_tac "Q \<longrightarrow> P" for P Q)+ apply (frule(2) descendants_range_inD[rotated]) apply (drule caps_of_state_valid_cap[OF _ obj]) apply (drule sym) apply (rule disjoint_subset2[OF usable_range_subseteq]) apply (simp add: valid_cap_def cap_aligned_def untyped_range.simps)+ apply (elim disjE conjE) apply (frule(2) descendants_range_inD[rotated]) apply (drule caps_of_state_valid_cap[OF _ obj])+ apply (drule sym) apply (simp add: untyped_range.simps) apply (drule(1) untyped_range_non_empty[OF _ valid_cap_aligned]) apply simp+ apply (case_tac "p' = cref") apply simp apply (intro conjI) apply (elim conjE) apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply (simp add: untyped_range_simp)+ apply (intro impI) apply (elim conjE | simp)+ apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply (frule(2) descendants_range_inD[rotated]) apply (drule caps_of_state_valid_cap[OF _ obj]) apply (drule sym) apply (rule disjoint_subset2[OF usable_range_subseteq]) apply ((clarsimp simp: valid_cap_def cap_aligned_def untyped_range.simps)+)[3] apply (intro impI) apply (elim conjE subset_splitE | simp)+ apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply (clarsimp simp: untyped_range.simps) apply simp apply (elim conjE) apply (thin_tac "P\<longrightarrow>Q" for P Q)+ apply (clarsimp simp: untyped_range.simps) apply simp apply (erule disjE) apply (clarsimp simp: blah) apply (clarsimp simp: blah) apply (drule_tac t = c' in sym) apply (simp add: untyped_range.simps) apply (drule_tac t= c' in sym) apply (intro impI) apply (simp add: untyped_range.simps) apply (elim disjE conjE) apply simp apply (frule(2) descendants_range_inD[rotated]) apply (drule caps_of_state_valid_cap[OF _ obj])+ apply simp apply (drule(1) untyped_range_non_empty[OF _ valid_cap_aligned]) apply simp+ done assume "ut_revocable (is_original_cap s) (caps_of_state s)" thus "ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using cstate by (fastforce simp: ut_revocable_def) assume "valid_arch_mdb (is_original_cap s) (caps_of_state s)" thus "valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using cstate by (fastforce elim!: valid_arch_mdb_untypeds) assume "reply_caps_mdb (cdt s) (caps_of_state s)" thus "reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" using cstate apply (simp add: reply_caps_mdb_def del: split_paired_All) apply (intro allI impI conjI) apply (drule spec)+ apply (erule(1) impE) apply (erule exE)+ apply (rule_tac x = ptr' in exI) apply clarsimp done assume "reply_masters_mdb (cdt s) (caps_of_state s)" thus "reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply (simp add: reply_masters_mdb_def del: split_paired_All) apply (intro allI impI ballI) apply (erule exE) apply (elim allE impE) apply simp using cstate apply fastforce done assume misc:
    "mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s)"
    "descendants_inc (cdt s) (caps_of_state s)"
    "caps_of_state s cref = Some (UntypedCap dev r bits f)" thus "descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))" apply - apply (erule descendants_inc_minor) apply (clarsimp simp: swp_def cte_wp_at_caps_of_state) apply (clarsimp simp: untyped_range.simps) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_objs s \<and> valid_mdb s \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s\<rbrace> set_cap (UntypedCap dev ptr sz idx) cref \<lbrace>\<lambda>rv. valid_mdb\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s\<rbrace> set_cap (UntypedCap dev ptr sz idx) cref \<lbrace>\<lambda>rv s'. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s') (cdt s') \<and> untyped_mdb (cdt s') (caps_of_state s') \<and> descendants_inc (cdt s') (caps_of_state s') \<and> no_mloop (cdt s') \<and> untyped_inc (cdt s') (caps_of_state s') \<and> ut_revocable (is_original_cap s') (caps_of_state s') \<and> irq_revocable (is_original_cap s') (caps_of_state s') \<and> reply_master_revocable (is_original_cap s') (caps_of_state s') \<and> reply_mdb (cdt s') (caps_of_state s') \<and> valid_arch_mdb (is_original_cap s') (caps_of_state s')\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<lbrace>?Q\<rbrace> set_cap (UntypedCap dev ptr sz idx) cref \<lbrace>\<lambda>rv s'. mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s') (cdt s') \<and> untyped_mdb (cdt s') (caps_of_state s') \<and> descendants_inc (cdt s') (caps_of_state s') \<and> no_mloop (cdt s') \<and> untyped_inc (cdt s') (caps_of_state s') \<and> ut_revocable (is_original_cap s') (caps_of_state s') \<and> irq_revocable (is_original_cap s') (caps_of_state s') \<and> reply_master_revocable (is_original_cap s') (caps_of_state s') \<and> reply_mdb (cdt s') (caps_of_state s') \<and> valid_arch_mdb (is_original_cap s') (caps_of_state s')\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'4\<rbrace> set_cap (UntypedCap dev ptr sz idx) cref \<lbrace>\<lambda>rv s. untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s)\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> UntypedCap dev ptr sz idx)) \<and> ?P'4 s proof (prove)
goal (2 subgoals):
 1. \<And>prev_s. \<lbrace>?P7 prev_s\<rbrace> set_cap (UntypedCap dev ptr sz idx) cref \<lbrace>\<lambda>rv s'. untyped_mdb (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> descendants_inc (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> no_mloop (cdt prev_s) \<and> untyped_inc (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> ut_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> irq_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_master_revocable (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_mdb (cdt prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> valid_arch_mdb (is_original_cap prev_s) ((caps_of_state prev_s)(cref \<mapsto> UntypedCap dev ptr sz idx))\<rbrace>
 2. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> UntypedCap dev ptr sz idx)) \<and> ?P7 s s proof (prove)
goal (1 subgoal):
 1. \<And>s. valid_objs s \<and> mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> untyped_mdb (cdt s) (caps_of_state s) \<and> descendants_inc (cdt s) (caps_of_state s) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) (caps_of_state s) \<and> ut_revocable (is_original_cap s) (caps_of_state s) \<and> irq_revocable (is_original_cap s) (caps_of_state s) \<and> reply_master_revocable (is_original_cap s) (caps_of_state s) \<and> reply_mdb (cdt s) (caps_of_state s) \<and> valid_arch_mdb (is_original_cap s) (caps_of_state s) \<and> descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s \<and> cte_wp_at (\<lambda>c. is_untyped_cap c \<and> cap_bits c = sz \<and> obj_ref_of c = ptr \<and> cap_is_device c = dev) cref s \<Longrightarrow> (mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s) \<and> (cref \<in> dom (cdt s) \<union> ran (cdt s) \<longrightarrow> NullCap \<noteq> UntypedCap dev ptr sz idx)) \<and> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> no_mloop (cdt s) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> irq_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_master_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
goal (1 subgoal):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> descendants_inc (cdt s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> untyped_inc (cdt s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> ut_revocable (is_original_cap s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> reply_caps_mdb (cdt s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> reply_masters_mdb (cdt s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) \<and> valid_arch_mdb (is_original_cap s) (\<lambda>a. if a = cref then Some (UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx) else caps_of_state s a) proof (prove)
goal (1 subgoal):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap (cap_is_device (UntypedCap dev ptr sz f)) (obj_ref_of (UntypedCap dev ptr sz f)) (cap_bits (UntypedCap dev ptr sz f)) idx)) proof (prove)
goal (1 subgoal):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) \<and> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
goal (7 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 7. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
goal (7 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 7. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
valid_objs s

goal (7 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 7. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
untyped_mdb (cdt s) (caps_of_state s)

goal (7 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 7. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (7 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 7. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
goal (1 subgoal):
 1. untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (3 subgoals):
 1. caps_of_state s cref = Some (UntypedCap dev r bits f)
 2. (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx) = (caps_of_state s)(cref \<mapsto> UntypedCap dev r bits ?x1)
 3. untyped_mdb (cdt s) (caps_of_state s) proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (6 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
untyped_inc (cdt s) (caps_of_state s)

goal (6 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
descendants_range_in {r..r + 2 ^ bits - 1} cref s

goal (6 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
goal (1 subgoal):
 1. untyped_range (UntypedCap dev r bits f) = untyped_range (UntypedCap dev r bits idx) proof (state)
this:
untyped_range (UntypedCap dev r bits f) = untyped_range (UntypedCap dev r bits idx)

goal (6 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
untyped_range (UntypedCap ?dev ?p ?n ?f) = {?p..?p + (1 << ?n) - 1}
untyped_range NullCap = {}
untyped_range (EndpointCap ?r ?badge ?rights) = {}
untyped_range (NotificationCap ?r ?badge ?rights) = {}
untyped_range (CNodeCap ?r ?bits ?guard) = {}
untyped_range (ThreadCap ?r) = {}
untyped_range DomainCap = {}
untyped_range (ReplyCap ?r ?master ?rights) = {}
untyped_range IRQControlCap = {}
untyped_range (IRQHandlerCap ?irq) = {}
untyped_range (Zombie ?r ?b ?n) = {}
untyped_range (ArchObjectCap ?cap) = {}
usable_untyped_range (UntypedCap ?uu ?p ?n ?f) = (if ?f < 2 ^ ?n then {?p + word_of_nat ?f..?p + 2 ^ ?n - 1} else {})
(?i \<in> {?l..?u}) = (?l \<le> ?i \<and> ?i \<le> ?u)
({?a..?b} \<subseteq> {?c..?d}) = (\<not> ?a \<le> ?b \<or> ?c \<le> ?a \<and> ?b \<le> ?d)
(?i \<in> {?l..<?u}) = (?l \<le> ?i \<and> ?i < ?u)
{?a..?b} \<inter> {?c..?d} = {max ?a ?c..min ?b ?d}
({?a..?b} = {}) = (\<not> ?a \<le> ?b)
(\<exists>x. ?P x) = (\<exists>a b. ?P (a, b))

goal (6 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 6. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
goal (1 subgoal):
 1. untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
untyped_inc (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)
descendants_range_in {r..r + 2 ^ bits - 1} cref s

goal (1 subgoal):
 1. untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>p p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s\<rbrakk> \<Longrightarrow> \<forall>p p' c c'. ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>\<forall>p p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>p' c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; (if p' = cref then Some c else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<inter> untyped_range c' = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p'); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> cref = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c' \<subset> untyped_range c \<longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {} \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> cap_aligned c
 2. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> is_untyped_cap c
 3. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p' \<in> descendants_of cref (cdt s); untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> cref \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}); p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c'\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c' \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c'; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {} cref s; is_untyped_cap c'; p = cref; p' \<noteq> cref; {r..r + 2 ^ bits - 1} = {}; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c' = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c'; c = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev r bits idx) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {} cref s; p = cref; p' \<noteq> cref; {r..r + 2 ^ bits - 1} = {}; p' \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c' = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c'; c = UntypedCap dev r bits idx; untyped_range c' \<noteq> {}\<rbrakk> \<Longrightarrow> usable_untyped_range (UntypedCap dev r bits idx) = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; UntypedCap dev r bits idx = c; is_untyped_cap c; caps_of_state s p' = Some c'; is_untyped_cap c'; p = cref; p' \<noteq> cref; untyped_range c = untyped_range c'; cref \<in> descendants_of p' (cdt s); usable_untyped_range c' = {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c = {} \<or> cref \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p = Some c; is_untyped_cap c; ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) p' = Some c'; is_untyped_cap c'; \<forall>c c'. caps_of_state s p = Some c \<longrightarrow> is_untyped_cap c \<longrightarrow> caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (1 subgoal):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p')
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {})
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c \<subset> untyped_range c' \<longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range c' \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; Some c = caps_of_state s p\<rbrakk> \<Longrightarrow> untyped_range c \<inter> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; Some c = caps_of_state s p\<rbrakk> \<Longrightarrow> cap_aligned c'
 2. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; Some c = caps_of_state s p\<rbrakk> \<Longrightarrow> is_untyped_cap c'
 3. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c \<subset> untyped_range c'; untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}; p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; Some c = caps_of_state s p\<rbrakk> \<Longrightarrow> untyped_range c \<inter> untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 6. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c' \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f); p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 6. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (6 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f); p \<in> descendants_of cref (cdt s); untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 6. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c; cref \<in> descendants_of p (cdt s); untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c; cref \<in> descendants_of p (cdt s); untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}\<rbrakk> \<Longrightarrow> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f); cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c = untyped_range (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (5 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f); untyped_range c = untyped_range (UntypedCap dev r bits f); cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f); untyped_range c = untyped_range (UntypedCap dev r bits f); p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 5. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (4 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range (UntypedCap dev r bits f); untyped_range c = untyped_range (UntypedCap dev r bits f); p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 4. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; is_untyped_cap c'; p \<noteq> cref; p' = cref; untyped_range c' \<subset> untyped_range c; untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}; untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}; c' = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; UntypedCap dev r bits idx = c'; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx\<rbrakk> \<Longrightarrow> untyped_range c = untyped_range c' \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; is_untyped_cap c'; (untyped_range c \<subseteq> untyped_range (UntypedCap dev r bits f) \<or> untyped_range (UntypedCap dev r bits f) \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range c \<subset> untyped_range (UntypedCap dev r bits f) \<longrightarrow> p \<in> descendants_of cref (cdt s) \<and> untyped_range c \<inter> usable_untyped_range (UntypedCap dev r bits f) = {}) \<and> (untyped_range (UntypedCap dev r bits f) \<subset> untyped_range c \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> untyped_range (UntypedCap dev r bits f) \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range (UntypedCap dev r bits f) \<longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}); p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = untyped_range c'\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range c' = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits f) = {}; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (3 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}; cref \<in> descendants_of p (cdt s); usable_untyped_range c = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 3. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {r..r + 2 ^ bits - 1} cref s; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {r..r + 2 ^ bits - 1}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; cap_range c \<inter> {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of cref (cdt s) \<and> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {} cref s; is_untyped_cap c; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal (2 subgoals):
 1. \<And>p p' c c'. \<lbrakk>descendants_range_in {} cref s; p \<noteq> cref; p' = cref; c' = UntypedCap dev r bits idx; untyped_range c = {}; p \<in> descendants_of cref (cdt s); usable_untyped_range (UntypedCap dev r bits f) = {}; {r..r + 2 ^ bits - 1} = {}; s \<turnstile> UntypedCap dev r bits f; s \<turnstile> c; untyped_range c \<noteq> {}\<rbrakk> \<Longrightarrow> cref \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> usable_untyped_range (UntypedCap dev r bits idx) = {}
 2. \<And>p p' c c'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); descendants_range_in {r..r + 2 ^ bits - 1} cref s; caps_of_state s p = Some c; is_untyped_cap c; (if p' = cref then Some (UntypedCap dev r bits idx) else caps_of_state s p') = Some c'; is_untyped_cap c'; \<forall>c'. caps_of_state s p' = Some c' \<longrightarrow> is_untyped_cap c' \<longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p'); p \<noteq> cref; p' \<noteq> cref\<rbrakk> \<Longrightarrow> (untyped_range c \<subseteq> untyped_range c' \<or> untyped_range c' \<subseteq> untyped_range c \<or> untyped_range c \<inter> untyped_range c' = {}) \<and> (untyped_range c \<subset> untyped_range c' \<longrightarrow> p \<in> descendants_of p' (cdt s) \<and> untyped_range c \<inter> usable_untyped_range c' = {}) \<and> (untyped_range c' \<subset> untyped_range c \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> untyped_range c' \<inter> usable_untyped_range c = {}) \<and> (untyped_range c = untyped_range c' \<longrightarrow> p' \<in> descendants_of p (cdt s) \<and> usable_untyped_range c = {} \<or> p \<in> descendants_of p' (cdt s) \<and> usable_untyped_range c' = {} \<or> p = p') proof (prove)
goal:
No subgoals! proof (state)
this:
untyped_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (5 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
ut_revocable (is_original_cap s) (caps_of_state s)

goal (5 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 5. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
using this:
ut_revocable (is_original_cap s) (caps_of_state s)

goal (1 subgoal):
 1. ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
ut_revocable (is_original_cap s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
ut_revocable (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (4 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
valid_arch_mdb (is_original_cap s) (caps_of_state s)

goal (4 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 4. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
using this:
valid_arch_mdb (is_original_cap s) (caps_of_state s)

goal (1 subgoal):
 1. valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
valid_arch_mdb (is_original_cap s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (state)
this:
valid_arch_mdb (is_original_cap s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (3 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
reply_caps_mdb (cdt s) (caps_of_state s)

goal (3 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 3. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
using this:
reply_caps_mdb (cdt s) (caps_of_state s)

goal (1 subgoal):
 1. reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
using this:
reply_caps_mdb (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<forall>ptr. ptr \<noteq> cref \<longrightarrow> (\<forall>t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)) \<longrightarrow> (\<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))); caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights)\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); (\<exists>rights. caps_of_state s (?ptr29 ptr t) = Some (ReplyCap (?t31 ptr t) False rights)) \<longrightarrow> (\<exists>ptr'. cdt s (?ptr29 ptr t) = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap (?t31 ptr t) True rights')))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; \<exists>rights. caps_of_state s ptr = Some (ReplyCap t False rights); \<exists>ptr'. cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t rights ptr'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> \<exists>ptr'. ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal (1 subgoal):
 1. \<And>ptr t rights ptr'. \<lbrakk>caps_of_state s cref = Some (UntypedCap dev r bits f); ptr \<noteq> cref; caps_of_state s ptr = Some (ReplyCap t False rights); cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref \<and> (ptr' \<noteq> cref \<longrightarrow> cdt s ptr = Some ptr' \<and> (\<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t True rights'))) proof (prove)
goal:
No subgoals! proof (state)
this:
reply_caps_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (2 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
reply_masters_mdb (cdt s) (caps_of_state s)

goal (2 subgoals):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx))
 2. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
using this:
reply_masters_mdb (cdt s) (caps_of_state s)

goal (1 subgoal):
 1. reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')) \<Longrightarrow> \<forall>ptr. ptr \<noteq> cref \<longrightarrow> (\<exists>t rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> (\<forall>ptr'\<in>descendants_of ptr (cdt s). ptr' \<noteq> cref) proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr'. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); ptr \<noteq> cref; \<exists>t rights. caps_of_state s ptr = Some (ReplyCap t True rights); ptr' \<in> descendants_of ptr (cdt s)\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>\<forall>ptr t. (\<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)) \<longrightarrow> cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights')); ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (2 subgoals):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights)\<rbrakk> \<Longrightarrow> \<exists>rights. caps_of_state s (?ptr36 ptr ptr' t) = Some (ReplyCap (?t37 ptr ptr' t) True rights)
 2. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s (?ptr36 ptr ptr' t) = None \<and> (\<forall>ptr'a\<in>descendants_of (?ptr36 ptr ptr' t) (cdt s). \<exists>rights'. caps_of_state s ptr'a = Some (ReplyCap (?t37 ptr ptr' t) False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
using this:
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. \<And>ptr ptr' t. \<lbrakk>ptr \<noteq> cref; ptr' \<in> descendants_of ptr (cdt s); \<exists>rights. caps_of_state s ptr = Some (ReplyCap t True rights); cdt s ptr = None \<and> (\<forall>ptr'\<in>descendants_of ptr (cdt s). \<exists>rights'. caps_of_state s ptr' = Some (ReplyCap t False rights'))\<rbrakk> \<Longrightarrow> ptr' \<noteq> cref proof (prove)
goal:
No subgoals! proof (state)
this:
reply_masters_mdb (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal (1 subgoal):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (state)
this:
mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)
descendants_inc (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. \<And>s f. \<lbrakk>valid_objs s; mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); untyped_mdb (cdt s) (caps_of_state s); descendants_inc (cdt s) (caps_of_state s); no_mloop (cdt s); untyped_inc (cdt s) (caps_of_state s); ut_revocable (is_original_cap s) (caps_of_state s); \<forall>a b. caps_of_state s (a, b) = Some IRQControlCap \<longrightarrow> is_original_cap s (a, b); \<forall>a b cap. caps_of_state s (a, b) = Some cap \<longrightarrow> (\<exists>x R. cap = ReplyCap x True R) \<longrightarrow> is_original_cap s (a, b); reply_caps_mdb (cdt s) (caps_of_state s); reply_masters_mdb (cdt s) (caps_of_state s); valid_arch_mdb (is_original_cap s) (caps_of_state s); descendants_range_in {ptr..ptr + 2 ^ sz - 1} cref s; caps_of_state s cref = Some (UntypedCap dev ptr sz f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev ptr sz idx)) proof (prove)
using this:
mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s)
descendants_inc (cdt s) (caps_of_state s)
caps_of_state s cref = Some (UntypedCap dev r bits f)

goal (1 subgoal):
 1. descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); descendants_inc (cdt s) (caps_of_state s); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> mdb_cte_at (\<lambda>p. \<exists>c. caps_of_state s p = Some c \<and> NullCap \<noteq> c) (cdt s)
 2. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_range (the (caps_of_state s x)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>mdb_cte_at (swp (cte_wp_at ((\<noteq>) NullCap)) s) (cdt s); caps_of_state s cref = Some (UntypedCap dev r bits f)\<rbrakk> \<Longrightarrow> \<forall>x\<in>dom (caps_of_state s). cap_class (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_class (the (caps_of_state s x)) \<and> cap_range (the (((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx)) x)) = cap_range (the (caps_of_state s x)) proof (prove)
goal:
No subgoals! proof (state)
this:
descendants_inc (cdt s) ((caps_of_state s)(cref \<mapsto> UntypedCap dev r bits idx))

goal:
No subgoals!