theory Example_Valid_StateH

lemma s0H_valid_pspace':
  notes pdeBits_def[simp] pteBits_def[simp] objBits_defs[simp]
  assumes "1 \<le> maxDomain"
  shows "valid_pspace' s0H_internal" using assms supply option.case_cong[cong] if_cong[cong] apply (clarsimp simp: valid_pspace'_def s0H_pspace_distinct' s0H_valid_objs') apply (intro conjI) apply (clarsimp simp: pspace_aligned'_def) apply (drule kh0H_SomeD) apply (elim disjE, simp_all add: s0_ptr_defs is_aligned_def kh0H_all_obj_def objBitsKO_def pageBits_def archObjSize_def irq_node_offs_range_def cte_level_bits_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def)[1] apply (clarsimp simp: no_0_obj'_def) apply (rule ccontr) apply clarsimp apply (drule kh0H_SomeD) apply (simp add: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def pd_offs_range_def pt_offs_range_def) apply (simp add: valid_mdb'_def) apply (clarsimp simp: valid_mdb_ctes_def) apply (intro conjI) apply (clarsimp simp: valid_dlist_def3) apply (rule conjI) apply (clarsimp simp: mdb_next_s0H) apply (subst mdb_prev_s0H) apply (fastforce simp: s0_ptr_defs) apply simp apply (clarsimp simp: mdb_prev_s0H) apply (subst mdb_next_s0H) apply (fastforce simp: s0_ptr_defs) apply simp apply (clarsimp simp: no_0_def) apply (rule ccontr) apply clarsimp apply (drule map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def)+)[1] apply (clarsimp simp: mdb_chain_0_def) apply (frule map_to_ctes_kh0H_SomeD) apply (elim disjE) apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5] apply (rule r_r_into_trancl) apply (erule next_fold) apply simp apply (rule next_fold) apply simp apply simp apply (rule r_r_into_trancl) apply (erule next_fold) apply simp apply (rule next_fold) apply simp apply simp apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[3] apply (rule r_r_into_trancl) apply (erule next_fold) apply simp apply (rule next_fold) apply simp apply simp apply (rule r_r_into_trancl) apply (erule next_fold) apply simp apply (rule next_fold) apply simp apply simp apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5] apply (clarsimp simp: Silc_cte_cte_def cnode_offs_range_def Silc_cte'_def Silc_capsH_def empty_cte_def split: if_split_asm) apply (rule r_r_into_trancl) apply (erule next_fold) apply simp apply (rule next_fold) apply simp apply simp apply (erule r_into_trancl[OF next_fold], simp) apply (erule r_into_trancl[OF next_fold], simp) apply (clarsimp simp: High_cte_cte_def cnode_offs_range_def High_cte'_def High_capsH_def empty_cte_def split: if_split_asm) apply ((erule r_into_trancl[OF next_fold], clarsimp)+)[5] apply (clarsimp simp: Low_cte_cte_def cnode_offs_range_def Low_cte'_def Low_capsH_def empty_cte_def split: if_split_asm) apply (rule trancl_into_trancl2) apply (erule next_fold) apply simp apply (rule r_r_into_trancl) apply (rule next_fold) apply simp apply simp apply (rule next_fold) apply simp apply simp apply (erule r_into_trancl[OF next_fold], simp)+ apply (clarsimp simp: valid_badges_def) apply (frule_tac x=p in map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: kh0H_all_obj_def Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def isCap_simps cnode_offs_range_def split: if_split_asm)+)[1] apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: kh0H_all_obj_def Low_cte_cte_def High_cte_cte_def Silc_cte_cte_def isCap_simps cnode_offs_range_def sameRegionAs_def split: if_split_asm)+)[1] apply (intro conjI impI) apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm) apply (drule(1) sameRegion_ntfn) apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm) apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: kh0H_all_obj_def High_cte_cte_def Low_cte_cte_def Silc_cte_cte_def split: if_split_asm)+)[1] apply (intro conjI impI) apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm) apply (drule(1) sameRegion_ntfn) apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def isCap_simps split: if_split_asm) apply (frule_tac x=p' in map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: kh0H_all_obj_def High_cte_cte_def Low_cte_cte_def Silc_cte_cte_def split: if_split_asm)+)[1] apply (clarsimp simp: caps_contained'_def) apply (drule_tac x=p in map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all)[1] apply (clarsimp simp: Silc_cte_cte_def kh0H_all_obj_def split: if_split_asm) apply (clarsimp simp: High_cte_cte_def kh0H_all_obj_def split: if_split_asm) apply (clarsimp simp: Low_cte_cte_def kh0H_all_obj_def split: if_split_asm) apply (clarsimp simp: mdb_chunked_def) apply (frule(3) sameRegionAs_s0H) apply (clarsimp simp: conj_disj_distribL) apply (subst mdb_next_trancl_s0H, fastforce simp: s0_ptr_defs)+ apply (elim disjE, simp_all)[1] apply (((rule conjI[rotated], fastforce simp: s0_ptr_defs
                   | simp only: conj_assoc[symmetric], rule conjI, fastforce simp: s0_ptr_defs),
                      clarsimp simp: is_chunk_def,
                      drule mdb_next_rtrancl_not_0_s0H, fastforce simp: s0_ptr_defs,
                      clarsimp simp: mdb_next_trancl_s0H,
                      (elim disjE, simp_all add: sameRegionAs_def isCap_simps kh0H_all_obj_def',
                          (fastforce simp: s0_ptr_defs)+)[1])+)[14] apply (clarsimp simp: untyped_mdb'_def) apply (drule_tac x=p in map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: untyped_inc'_def) apply (rule FalseE) apply (drule_tac x=p in map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: valid_nullcaps_def) apply (drule map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: kh0H_all_obj_def' nullMDBNode_def) apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: ut_revocable'_def) apply (drule map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: class_links_def) apply (subst(asm) mdb_next_s0H) apply (drule_tac x=p' in map_to_ctes_kh0H_SomeD) apply (elim disjE, (clarsimp simp: s0_ptr_defs irq_node_offs_range_def cnode_offs_range_def)+)[1] apply (elim disjE, (clarsimp simp: kh0H_all_obj_def')+)[1] apply (clarsimp simp: distinct_zombies_def distinct_zombie_caps_def) apply (drule_tac x=ptr in map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: irq_control_def) apply (drule map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] apply (clarsimp simp: reply_masters_rvk_fb_def ran_def) apply (frule map_to_ctes_kh0H_SomeD) apply (elim disjE, simp_all add: isCap_simps kh0H_all_obj_def')[1] apply ((clarsimp split: if_split_asm)+)[3] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. valid_pspace' s0H_internal proof (prove)
using this:
1 \<le> maxDomain

goal (1 subgoal):
 1. valid_pspace' s0H_internal proof (prove)
using this:
1 \<le> maxDomain

goal (1 subgoal):
 1. valid_pspace' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_aligned' s0H_internal \<and> no_0_obj' s0H_internal \<and> valid_mdb' s0H_internal proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> pspace_aligned' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> no_0_obj' s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; kh0H x = Some y\<rbrakk> \<Longrightarrow> is_aligned x (objBitsKO y)
 2. 1 \<le> maxDomain \<Longrightarrow> no_0_obj' s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (3 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; x = init_globals_frame \<and> y = KOUserData \<or> x = idle_tcb_ptr \<and> y = KOTCB idle_tcbH \<or> x = High_tcb_ptr \<and> y = KOTCB High_tcbH \<or> x = Low_tcb_ptr \<and> y = KOTCB Low_tcbH \<or> x = ntfn_ptr \<and> y = KONotification ntfnH \<or> x = irq_cnode_ptr \<and> y = KOCTE irq_cte \<or> x \<in> irq_node_offs_range \<and> y = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte Low_cnode_ptr x) \<or> x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte High_cnode_ptr x) \<or> x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte Silc_cnode_ptr x) \<or> x \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd x \<noteq> None \<and> y = the (global_pdH' init_global_pd x) \<or> x \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr x \<noteq> None \<and> y = the (High_pdH High_pd_ptr x) \<or> x \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr x \<noteq> None \<and> y = the (Low_pdH Low_pd_ptr x) \<or> x \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr x \<noteq> None \<and> y = the (High_ptH High_pt_ptr x) \<or> x \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr x \<noteq> None \<and> y = the (Low_ptH Low_pt_ptr x)\<rbrakk> \<Longrightarrow> is_aligned x (objBitsKO y)
 2. 1 \<le> maxDomain \<Longrightarrow> no_0_obj' s0H_internal
 3. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> no_0_obj' s0H_internal
 2. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> kh0H 0 = None
 2. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; kh0H 0 \<noteq> None\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; kh0H 0 = Some y\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (2 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; 0 = init_globals_frame \<and> y = KOUserData \<or> 0 = idle_tcb_ptr \<and> y = KOTCB idle_tcbH \<or> 0 = High_tcb_ptr \<and> y = KOTCB High_tcbH \<or> 0 = Low_tcb_ptr \<and> y = KOTCB Low_tcbH \<or> 0 = ntfn_ptr \<and> y = KONotification ntfnH \<or> 0 = irq_cnode_ptr \<and> y = KOCTE irq_cte \<or> 0 \<in> irq_node_offs_range \<and> y = KOCTE (CTE capability.NullCap (MDB 0 0 False False)) \<or> 0 \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte Low_cnode_ptr 0 \<noteq> None \<and> y = the (Low_cte Low_cnode_ptr 0) \<or> 0 \<in> cnode_offs_range High_cnode_ptr \<and> High_cte High_cnode_ptr 0 \<noteq> None \<and> y = the (High_cte High_cnode_ptr 0) \<or> 0 \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte Silc_cnode_ptr 0 \<noteq> None \<and> y = the (Silc_cte Silc_cnode_ptr 0) \<or> 0 \<in> pd_offs_range init_global_pd \<and> global_pdH' init_global_pd 0 \<noteq> None \<and> y = the (global_pdH' init_global_pd 0) \<or> 0 \<in> pd_offs_range High_pd_ptr \<and> High_pdH High_pd_ptr 0 \<noteq> None \<and> y = the (High_pdH High_pd_ptr 0) \<or> 0 \<in> pd_offs_range Low_pd_ptr \<and> Low_pdH Low_pd_ptr 0 \<noteq> None \<and> y = the (Low_pdH Low_pd_ptr 0) \<or> 0 \<in> pt_offs_range High_pt_ptr \<and> High_ptH High_pt_ptr 0 \<noteq> None \<and> y = the (High_ptH High_pt_ptr 0) \<or> 0 \<in> pt_offs_range Low_pt_ptr \<and> Low_ptH Low_pt_ptr 0 \<noteq> None \<and> y = the (Low_ptH Low_pt_ptr 0)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_mdb' s0H_internal proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_mdb_ctes (map_to_ctes kh0H) proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_dlist (map_to_ctes kh0H) \<and> no_0 (map_to_ctes kh0H) \<and> mdb_chain_0 (map_to_ctes kh0H) \<and> valid_badges (map_to_ctes kh0H) \<and> caps_contained' (map_to_ctes kh0H) \<and> mdb_chunked (map_to_ctes kh0H) \<and> untyped_mdb' (map_to_ctes kh0H) \<and> untyped_inc' (map_to_ctes kh0H) \<and> valid_nullcaps (map_to_ctes kh0H) \<and> ut_revocable' (map_to_ctes kh0H) \<and> class_links (map_to_ctes kh0H) \<and> distinct_zombies (map_to_ctes kh0H) \<and> irq_control (map_to_ctes kh0H) \<and> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_dlist (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> (\<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leftarrow> c') \<and> (\<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c')
 2. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leadsto> c' \<longrightarrow> c' \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leftarrow> c'
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 3. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c' \<noteq> 0\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> c \<leftarrow> c'
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 3. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c' \<noteq> 0\<rbrakk> \<Longrightarrow> c \<noteq> 0
 2. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c' \<noteq> 0\<rbrakk> \<Longrightarrow> c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30
 3. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 4. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c' \<noteq> 0\<rbrakk> \<Longrightarrow> c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30
 2. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 3. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> \<forall>c c'. map_to_ctes kh0H \<turnstile> c \<leftarrow> c' \<longrightarrow> c \<noteq> 0 \<longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 2. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c \<noteq> 0\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> c \<leadsto> c'
 2. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c \<noteq> 0\<rbrakk> \<Longrightarrow> c' \<noteq> 0
 2. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c \<noteq> 0\<rbrakk> \<Longrightarrow> c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30
 3. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>c c'. \<lbrakk>1 \<le> maxDomain; c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30; c \<noteq> 0\<rbrakk> \<Longrightarrow> c = Low_cnode_ptr + 0x13E0 \<and> c' = Silc_cnode_ptr + 0x13E0 \<or> c = Silc_cnode_ptr + 0x13E0 \<and> c' = High_cnode_ptr + 0x13E0 \<or> c = Low_tcb_ptr \<and> c' = Low_cnode_ptr + 0x20 \<or> c = Low_tcb_ptr + 0x10 \<and> c' = Low_cnode_ptr + 0x30 \<or> c = High_tcb_ptr \<and> c' = High_cnode_ptr + 0x20 \<or> c = High_tcb_ptr + 0x10 \<and> c' = High_cnode_ptr + 0x30
 2. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> no_0 (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> map_to_ctes kh0H 0 = None
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H 0 \<noteq> None\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H 0 = Some y\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>y. \<lbrakk>1 \<le> maxDomain; 0 = idle_tcb_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = idle_tcb_ptr + 0x10 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = idle_tcb_ptr + 0x20 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = idle_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = idle_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> 0 = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> 0 = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> 0 = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> 0 = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> 0 = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> 0 = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> 0 \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr 0 \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr 0) \<or> 0 \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr 0 \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr 0) \<or> 0 \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr 0 \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr 0)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> mdb_chain_0 (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = idle_tcb_ptr + 0x10 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = idle_tcb_ptr + 0x20 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = idle_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = idle_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False) \<or> x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x) \<or> x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x) \<or> x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr + 0x10 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr + 0x20 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = idle_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 31 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b300 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b300 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode y) = ?b300 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b300 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> Low_cnode_ptr + 0x20 \<leadsto> 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + 0x20) = Some (?cte306 x y)
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte306 x y)) = 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr \<and> y = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 x False False))) = 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b310 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b310 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode y) = ?b310 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b310 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> Low_cnode_ptr + 0x30 \<leadsto> 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (Low_cnode_ptr + 0x30) = Some (?cte316 x y)
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte316 x y)) = 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 x False False))) = 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = Low_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 24 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b331 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b331 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode y) = ?b331 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b331 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> High_cnode_ptr + 0x20 \<leadsto> 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + 0x20) = Some (?cte337 x y)
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte337 x y)) = 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr \<and> y = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 x False False))) = 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b341 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b341 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode y) = ?b341 x y
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b341 x y \<leadsto> 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> High_cnode_ptr + 0x30 \<leadsto> 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + 0x30) = Some (?cte347 x y)
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte347 x y)) = 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x10 \<and> y = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False)\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 x False False))) = 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 10. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x20 \<and> y = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x30 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = High_tcb_ptr + 0x40 \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x = irq_cnode_ptr \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> irq_node_offs_range \<and> y = CTE capability.NullCap (MDB 0 0 False False)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 9. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
A total of 19 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr x \<noteq> None \<and> y = the (Silc_cte_cte Silc_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b407 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b407 x \<leadsto> 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))) = ?b407 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b407 x \<leadsto> 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> High_cnode_ptr + 0x13E0 \<leadsto> 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + 0x13E0) = Some (?cte413 x)
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte413 x)) = 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False))) = 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)); 1 \<le> maxDomain; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Silc_cnode_ptr \<le> x; x \<le> 0x3FFF + Silc_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Silc_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr x \<noteq> None \<and> y = the (High_cte_cte High_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; High_cnode_ptr \<le> x; x \<le> 0x3FFF + High_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; High_cnode_ptr \<le> x; x \<le> 0x3FFF + High_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)); 1 \<le> maxDomain; High_cnode_ptr \<le> x; x \<le> 0x3FFF + High_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; High_cnode_ptr \<le> x; x \<le> 0x3FFF + High_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; High_cnode_ptr \<le> x; x \<le> 0x3FFF + High_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - High_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x y. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H x = Some y; x \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr x \<noteq> None \<and> y = the (Low_cte_cte Low_cnode_ptr x)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto> ?b574 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b574 x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))) = ?b574 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b574 x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> Silc_cnode_ptr + 0x13E0 \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> Silc_cnode_ptr + 0x13E0 \<leadsto> ?b580 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b580 x \<leadsto> 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (Silc_cnode_ptr + 0x13E0) = Some (?cte583 x)
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte583 x)) = ?b580 x
 3. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b580 x \<leadsto> 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 8. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False))) = ?b580 x
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> ?b580 x \<leadsto> 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> High_cnode_ptr + 0x13E0 \<leadsto> 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> map_to_ctes kh0H (High_cnode_ptr + 0x13E0) = Some (?cte588 x)
 2. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (?cte588 x)) = 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 7. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>x. \<lbrakk>1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; map_to_ctes kh0H x = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False))\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False))) = 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 6. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 2. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 3. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)); 1 \<le> maxDomain; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 4. \<And>x. \<lbrakk>map_to_ctes kh0H x = Some (CTE capability.NullCap (MDB 0 0 False False)); 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 318; Low_cnode_ptr \<le> x; x \<le> 0x3FFF + Low_cnode_ptr; is_aligned x cte_level_bits; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 3; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 2; to_bl (UCAST(32 \<rightarrow> 10) (x - Low_cnode_ptr >> cte_level_bits)) \<noteq> the_nat_to_bl 10 (Suc 0)\<rbrakk> \<Longrightarrow> map_to_ctes kh0H \<turnstile> x \<leadsto>\<^sup>+ 0
 5. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
A total of 15 subgoals... proof (prove)
goal (11 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_badges (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p = idle_tcb_ptr \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE cap node = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE cap node = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE cap node = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE cap node = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE cap node = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE cap node = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE cap node = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>p p' cap' node'. \<lbrakk>map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs (capability.NotificationCap ntfn_ptr 0 True False) cap'; 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> p; p \<le> 0x3FFF + Silc_cnode_ptr; is_aligned p cte_level_bits; map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); capNtfnBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>p p' cap' node'. \<lbrakk>map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs (capability.NotificationCap ntfn_ptr 0 True False) cap'; 1 \<le> maxDomain; to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; Silc_cnode_ptr \<le> p; p \<le> 0x3FFF + Silc_cnode_ptr; is_aligned p cte_level_bits; map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)); capNtfnBadge cap' \<noteq> 0; p' = idle_tcb_ptr \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x10 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x20 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x30 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x40 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr \<and> CTE cap' node' = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p' = Low_tcb_ptr + 0x10 \<and> CTE cap' node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p' = Low_tcb_ptr + 0x20 \<and> CTE cap' node' = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = Low_tcb_ptr + 0x30 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr + 0x40 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr \<and> CTE cap' node' = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p' = High_tcb_ptr + 0x10 \<and> CTE cap' node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p' = High_tcb_ptr + 0x20 \<and> CTE cap' node' = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = High_tcb_ptr + 0x30 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr + 0x40 \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = irq_cnode_ptr \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> irq_node_offs_range \<and> CTE cap' node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p' \<noteq> None \<and> CTE cap' node' = the (Silc_cte_cte Silc_cnode_ptr p') \<or> p' \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p' \<noteq> None \<and> CTE cap' node' = the (High_cte_cte High_cnode_ptr p') \<or> p' \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p' \<noteq> None \<and> CTE cap' node' = the (Low_cte_cte Low_cnode_ptr p')\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p); isEndpointCap cap; capEPBadge cap \<noteq> capEPBadge cap'; capEPBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 3. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 4. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap node = the (High_cte_cte High_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0; isNotificationCap cap'\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' node' v0a v1a v2a v3a. \<lbrakk>map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); map_to_ctes kh0H p' = Some (CTE (capability.NotificationCap v0a v1a v2a v3a) node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; v1a \<noteq> 0; 1 \<le> maxDomain; p \<in> cnode_offs_range High_cnode_ptr; is_aligned p cte_level_bits; High_cnode_ptr \<le> p; p \<le> 0x3FFF + High_cnode_ptr; to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' node' v0a v1a v2a v3a. \<lbrakk>map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)); map_to_ctes kh0H p' = Some (CTE (capability.NotificationCap v0a v1a v2a v3a) node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; v1a \<noteq> 0; 1 \<le> maxDomain; p \<in> cnode_offs_range High_cnode_ptr; is_aligned p cte_level_bits; High_cnode_ptr \<le> p; p \<le> 0x3FFF + High_cnode_ptr; to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; p' = idle_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p' = Low_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p' = Low_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = Low_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p' = High_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p' = High_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = High_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = irq_cnode_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> irq_node_offs_range \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (Silc_cte_cte Silc_cnode_ptr p') \<or> p' \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (High_cte_cte High_cnode_ptr p') \<or> p' \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (Low_cte_cte Low_cnode_ptr p')\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p); isEndpointCap cap; capEPBadge cap \<noteq> capEPBadge cap'; capEPBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 3. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; global.sameRegionAs cap cap'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' cap node cap' node'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap node); map_to_ctes kh0H p' = Some (CTE cap' node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap node = the (Low_cte_cte Low_cnode_ptr p); isNotificationCap cap; capNtfnBadge cap \<noteq> capNtfnBadge cap'; capNtfnBadge cap' \<noteq> 0; isNotificationCap cap'\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' node' v0a v1a v2a v3a. \<lbrakk>map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); map_to_ctes kh0H p' = Some (CTE (capability.NotificationCap v0a v1a v2a v3a) node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; v1a \<noteq> 0; 1 \<le> maxDomain; p \<in> cnode_offs_range Low_cnode_ptr; is_aligned p cte_level_bits; Low_cnode_ptr \<le> p; p \<le> 0x3FFF + Low_cnode_ptr; to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' node' v0a v1a v2a v3a. \<lbrakk>map_to_ctes kh0H p = Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)); map_to_ctes kh0H p' = Some (CTE (capability.NotificationCap v0a v1a v2a v3a) node'); map_to_ctes kh0H \<turnstile> p \<leadsto> p'; v1a \<noteq> 0; 1 \<le> maxDomain; p \<in> cnode_offs_range Low_cnode_ptr; is_aligned p cte_level_bits; Low_cnode_ptr \<le> p; p \<le> 0x3FFF + Low_cnode_ptr; to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318; p' = idle_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p' = Low_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p' = Low_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = Low_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p' = High_tcb_ptr + 0x10 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p' = High_tcb_ptr + 0x20 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = High_tcb_ptr + 0x30 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr + 0x40 \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = irq_cnode_ptr \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> irq_node_offs_range \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (Silc_cte_cte Silc_cnode_ptr p') \<or> p' \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (High_cte_cte High_cnode_ptr p') \<or> p' \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p' \<noteq> None \<and> CTE (capability.NotificationCap v0a v1a v2a v3a) node' = the (Low_cte_cte Low_cnode_ptr p')\<rbrakk> \<Longrightarrow> mdbFirstBadged node'
 2. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> caps_contained' (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (10 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE c n); map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (10 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p = idle_tcb_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE c n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE c n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (12 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. Silc_cte_cte Silc_cnode_ptr p = Some y) \<and> CTE c n = the (Silc_cte_cte Silc_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte_cte High_cnode_ptr p = Some y) \<and> CTE c n = the (High_cte_cte High_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte_cte Low_cnode_ptr p = Some y) \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 4. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. High_cte_cte High_cnode_ptr p = Some y) \<and> CTE c n = the (High_cte_cte High_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte_cte Low_cnode_ptr p = Some y) \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 3. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>p p' c n c' n' x. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; x \<in> capRange c'; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. Low_cte_cte Low_cnode_ptr p = Some y) \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> x \<in> untypedRange c
 2. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> mdb_chunked (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap n); map_to_ctes kh0H p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'\<rbrakk> \<Longrightarrow> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<or> map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (map_to_ctes kh0H) cap p p') \<and> (map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' p' p)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap n); map_to_ctes kh0H p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; p = Low_cnode_ptr + 0x13E0 \<and> (p' = Silc_cnode_ptr + 0x13E0 \<or> p' = High_cnode_ptr + 0x13E0) \<or> p = Silc_cnode_ptr + 0x13E0 \<and> (p' = Low_cnode_ptr + 0x13E0 \<or> p' = High_cnode_ptr + 0x13E0) \<or> p = High_cnode_ptr + 0x13E0 \<and> (p' = Low_cnode_ptr + 0x13E0 \<or> p' = Silc_cnode_ptr + 0x13E0) \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_cnode_ptr + 0x20 \<and> p' = Low_tcb_ptr \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = Low_cnode_ptr + 0x30 \<and> p' = Low_tcb_ptr + 0x10 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_cnode_ptr + 0x20 \<and> p' = High_tcb_ptr \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30 \<or> p = High_cnode_ptr + 0x30 \<and> p' = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<or> map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (map_to_ctes kh0H) cap p p') \<and> (map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' p' p)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap n); map_to_ctes kh0H p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Low_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = Low_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = High_cnode_ptr + 0x13E0 \<and> p' = Low_cnode_ptr + 0x13E0 \<or> p = High_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_cnode_ptr + 0x20 \<and> p' = Low_tcb_ptr \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = Low_cnode_ptr + 0x30 \<and> p' = Low_tcb_ptr + 0x10 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_cnode_ptr + 0x20 \<and> p' = High_tcb_ptr \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30 \<or> p = High_cnode_ptr + 0x30 \<and> p' = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<or> map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p) \<and> (map_to_ctes kh0H \<turnstile> p \<leadsto>\<^sup>+ p' \<longrightarrow> is_chunk (map_to_ctes kh0H) cap p p') \<and> (map_to_ctes kh0H \<turnstile> p' \<leadsto>\<^sup>+ p \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' p' p)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. \<And>p p' cap n cap' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap n); map_to_ctes kh0H p' = Some (CTE cap' n'); global.sameRegionAs cap cap'; p \<noteq> p'; p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Low_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = Low_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = High_cnode_ptr + 0x13E0 \<and> p' = Low_cnode_ptr + 0x13E0 \<or> p = High_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_cnode_ptr + 0x20 \<and> p' = Low_tcb_ptr \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = Low_cnode_ptr + 0x30 \<and> p' = Low_tcb_ptr + 0x10 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_cnode_ptr + 0x20 \<and> p' = High_tcb_ptr \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30 \<or> p = High_cnode_ptr + 0x30 \<and> p' = High_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> ((p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30) \<or> p' = Low_cnode_ptr + 0x13E0 \<and> p = Silc_cnode_ptr + 0x13E0 \<or> p' = Silc_cnode_ptr + 0x13E0 \<and> p = High_cnode_ptr + 0x13E0 \<or> p' = Low_cnode_ptr + 0x13E0 \<and> p = High_cnode_ptr + 0x13E0 \<or> p' = Low_tcb_ptr \<and> p = Low_cnode_ptr + 0x20 \<or> p' = Low_tcb_ptr + 0x10 \<and> p = Low_cnode_ptr + 0x30 \<or> p' = High_tcb_ptr \<and> p = High_cnode_ptr + 0x20 \<or> p' = High_tcb_ptr + 0x10 \<and> p = High_cnode_ptr + 0x30) \<and> (p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap p p') \<and> (p' = Low_cnode_ptr + 0x13E0 \<and> p = Silc_cnode_ptr + 0x13E0 \<or> p' = Silc_cnode_ptr + 0x13E0 \<and> p = High_cnode_ptr + 0x13E0 \<or> p' = Low_cnode_ptr + 0x13E0 \<and> p = High_cnode_ptr + 0x13E0 \<or> p' = Low_tcb_ptr \<and> p = Low_cnode_ptr + 0x20 \<or> p' = Low_tcb_ptr + 0x10 \<and> p = Low_cnode_ptr + 0x30 \<or> p' = High_tcb_ptr \<and> p = High_cnode_ptr + 0x20 \<or> p' = High_tcb_ptr + 0x10 \<and> p = High_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' p' p)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (22 subgoals):
 1. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; MDB (Silc_cnode_ptr + 0x13E0) 0 False False = n; cap = capability.NotificationCap ntfn_ptr 0 True False; global.sameRegionAs (capability.NotificationCap ntfn_ptr 0 True False) (capability.NotificationCap ntfn_ptr 0 True False); p = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) (Low_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0) \<and> (Silc_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) High_tcb_ptr (Low_cnode_ptr + 0x13E0)) \<and> (0x13D0 + Silc_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) (Silc_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0))
 2. \<And>p cap cap'. \<lbrakk>1 \<le> maxDomain; capability.NotificationCap ntfn_ptr 0 True False = cap; capability.NotificationCap ntfn_ptr 0 False True = cap'; global.sameRegionAs cap cap'; p = Low_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x13E0) (High_cnode_ptr + 0x13E0) \<and> (High_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' High_tcb_ptr (Low_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0))
 3. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False = n; cap = capability.NotificationCap ntfn_ptr 0 True False; global.sameRegionAs (capability.NotificationCap ntfn_ptr 0 True False) (capability.NotificationCap ntfn_ptr 0 True False); p = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> (Silc_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) High_tcb_ptr (Low_cnode_ptr + 0x13E0)) \<and> (0x13D0 + Silc_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) (Silc_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0)) \<and> is_chunk (map_to_ctes kh0H) (capability.NotificationCap ntfn_ptr 0 True False) (Low_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0)
 4. \<And>p cap cap'. \<lbrakk>1 \<le> maxDomain; capability.NotificationCap ntfn_ptr 0 True False = cap; capability.NotificationCap ntfn_ptr 0 False True = cap'; global.sameRegionAs cap cap'; p = Silc_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> is_chunk (map_to_ctes kh0H) cap (Silc_cnode_ptr + 0x13E0) (High_cnode_ptr + 0x13E0) \<and> (High_cnode_ptr + 0x13E0 = Low_tcb_ptr \<and> 0x13C0 + Silc_cnode_ptr = Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' Low_tcb_ptr (Silc_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = Low_tcb_ptr \<and> 0x13B0 + Silc_cnode_ptr = Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (High_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0)) \<and> (High_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Silc_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' High_tcb_ptr (Silc_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Silc_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (High_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0))
 5. \<And>p cap cap'. \<lbrakk>1 \<le> maxDomain; capability.NotificationCap ntfn_ptr 0 False True = cap; capability.NotificationCap ntfn_ptr 0 True False = cap'; global.sameRegionAs cap cap'; p = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> (High_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap High_tcb_ptr (Low_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Low_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0)) \<and> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x13E0) (High_cnode_ptr + 0x13E0)
 6. \<And>p cap cap'. \<lbrakk>1 \<le> maxDomain; capability.NotificationCap ntfn_ptr 0 False True = cap; capability.NotificationCap ntfn_ptr 0 True False = cap'; global.sameRegionAs cap cap'; p = High_cnode_ptr + 0x13E0\<rbrakk> \<Longrightarrow> (High_cnode_ptr + 0x13E0 = Low_tcb_ptr \<and> 0x13C0 + Silc_cnode_ptr = Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap Low_tcb_ptr (Silc_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = Low_tcb_ptr \<and> 0x13B0 + Silc_cnode_ptr = Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (High_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0)) \<and> (High_cnode_ptr + 0x13E0 = High_tcb_ptr \<and> 0x13C0 + Silc_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap High_tcb_ptr (Silc_cnode_ptr + 0x13E0)) \<and> (0x13D0 + High_cnode_ptr = High_tcb_ptr \<and> 0x13B0 + Silc_cnode_ptr = High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (High_cnode_ptr + 0x13E0) (Silc_cnode_ptr + 0x13E0)) \<and> is_chunk (map_to_ctes kh0H) cap' (Silc_cnode_ptr + 0x13E0) (High_cnode_ptr + 0x13E0)
 7. \<And>p cap n cap'. \<lbrakk>1 \<le> maxDomain; Low_tcb_cte Low_tcb_ptr = Some (CTE cap n); capability.CNodeCap Low_cnode_ptr 10 2 10 = cap'; global.sameRegionAs cap cap'; Low_tcb_ptr \<noteq> Low_cnode_ptr + 0x20; p = Low_tcb_ptr\<rbrakk> \<Longrightarrow> is_chunk (map_to_ctes kh0H) cap Low_tcb_ptr (Low_cnode_ptr + 0x20) \<and> (Low_cnode_ptr = 0x13C0 + Silc_cnode_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x13E0 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x20) Low_tcb_ptr) \<and> (0x10 + Low_cnode_ptr = Low_tcb_ptr \<and> Low_tcb_ptr = Low_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x20) Low_tcb_ptr) \<and> (Low_cnode_ptr + 0x20 = High_tcb_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x20 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' High_tcb_ptr Low_tcb_ptr) \<and> (0x10 + Low_cnode_ptr = High_tcb_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x20) Low_tcb_ptr)
 8. \<And>p cap cap' n'. \<lbrakk>1 \<le> maxDomain; capability.CNodeCap Low_cnode_ptr 10 2 10 = cap; Low_tcb_cte Low_tcb_ptr = Some (CTE cap' n'); global.sameRegionAs cap cap'; Low_cnode_ptr + 0x20 \<noteq> Low_tcb_ptr; p = Low_cnode_ptr + 0x20\<rbrakk> \<Longrightarrow> (Low_cnode_ptr = 0x13C0 + Silc_cnode_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x13E0 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x20) Low_tcb_ptr) \<and> (0x10 + Low_cnode_ptr = Low_tcb_ptr \<and> Low_tcb_ptr = Low_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x20) Low_tcb_ptr) \<and> (Low_cnode_ptr + 0x20 = High_tcb_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x20 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap High_tcb_ptr Low_tcb_ptr) \<and> (0x10 + Low_cnode_ptr = High_tcb_ptr \<and> Low_tcb_ptr = High_cnode_ptr + 0x30 \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x20) Low_tcb_ptr) \<and> is_chunk (map_to_ctes kh0H) cap' Low_tcb_ptr (Low_cnode_ptr + 0x20)
 9. \<And>p cap n cap'. \<lbrakk>1 \<le> maxDomain; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some (CTE cap n); capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid)) = cap'; global.sameRegionAs cap cap'; Low_tcb_ptr \<noteq> 0x20 + Low_cnode_ptr; p = Low_tcb_ptr + 0x10\<rbrakk> \<Longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_tcb_ptr + 0x10) (Low_cnode_ptr + 0x30) \<and> (Low_cnode_ptr = 0x13B0 + Silc_cnode_ptr \<and> Low_tcb_ptr = 0x13D0 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x30) (Low_tcb_ptr + 0x10)) \<and> (Low_cnode_ptr + 0x30 = Low_tcb_ptr \<and> Low_tcb_ptr = 0x10 + Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' Low_tcb_ptr (Low_tcb_ptr + 0x10)) \<and> (Low_cnode_ptr + 0x30 = High_tcb_ptr \<and> Low_tcb_ptr = 0x10 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' High_tcb_ptr (Low_tcb_ptr + 0x10)) \<and> (0x20 + Low_cnode_ptr = High_tcb_ptr \<and> Low_tcb_ptr = 0x20 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap' (Low_cnode_ptr + 0x30) (Low_tcb_ptr + 0x10))
 10. \<And>p cap cap' n'. \<lbrakk>1 \<le> maxDomain; capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid)) = cap; Low_tcb_cte (Low_tcb_ptr + 0x10) = Some (CTE cap' n'); global.sameRegionAs cap cap'; 0x20 + Low_cnode_ptr \<noteq> Low_tcb_ptr; p = Low_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> (Low_cnode_ptr = 0x13B0 + Silc_cnode_ptr \<and> Low_tcb_ptr = 0x13D0 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x30) (Low_tcb_ptr + 0x10)) \<and> (Low_cnode_ptr + 0x30 = Low_tcb_ptr \<and> Low_tcb_ptr = 0x10 + Low_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap Low_tcb_ptr (Low_tcb_ptr + 0x10)) \<and> (Low_cnode_ptr + 0x30 = High_tcb_ptr \<and> Low_tcb_ptr = 0x10 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap High_tcb_ptr (Low_tcb_ptr + 0x10)) \<and> (0x20 + Low_cnode_ptr = High_tcb_ptr \<and> Low_tcb_ptr = 0x20 + High_cnode_ptr \<longrightarrow> is_chunk (map_to_ctes kh0H) cap (Low_cnode_ptr + 0x30) (Low_tcb_ptr + 0x10)) \<and> is_chunk (map_to_ctes kh0H) cap' (Low_tcb_ptr + 0x10) (Low_cnode_ptr + 0x30)
A total of 22 subgoals... proof (prove)
goal (8 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> untyped_mdb' (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (8 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE c n); isUntypedCap c; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (8 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; isUntypedCap c; map_to_ctes kh0H p' = Some (CTE c' n'); \<not> isUntypedCap c'; capRange c' \<inter> untypedRange c \<noteq> {}; p = idle_tcb_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE c n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE c n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (10 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<forall>d v0 v1 f. c' \<noteq> capability.UntypedCap d v0 v1 f; capRange c' \<inter> untypedRange c \<noteq> {}; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H)
 2. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<forall>d v0 v1 f. c' \<noteq> capability.UntypedCap d v0 v1 f; capRange c' \<inter> untypedRange c \<noteq> {}; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H)
 3. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<forall>d v0 v1 f. c' \<noteq> capability.UntypedCap d v0 v1 f; capRange c' \<inter> untypedRange c \<noteq> {}; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 10. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (7 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> untyped_inc' (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE c n); isUntypedCap c; map_to_ctes kh0H p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> (untypedRange c \<subseteq> untypedRange c' \<or> untypedRange c' \<subseteq> untypedRange c \<or> untypedRange c \<inter> untypedRange c' = {}) \<and> (untypedRange c \<subset> untypedRange c' \<longrightarrow> p \<in> descendants_of' p' (map_to_ctes kh0H) \<and> untypedRange c \<inter> usableUntypedRange c' = {}) \<and> (untypedRange c' \<subset> untypedRange c \<longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H) \<and> untypedRange c' \<inter> usableUntypedRange c = {}) \<and> (untypedRange c = untypedRange c' \<longrightarrow> p' \<in> descendants_of' p (map_to_ctes kh0H) \<and> usableUntypedRange c = {} \<or> p \<in> descendants_of' p' (map_to_ctes kh0H) \<and> usableUntypedRange c' = {} \<or> p = p')
 2. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE c n); isUntypedCap c; map_to_ctes kh0H p' = Some (CTE c' n'); isUntypedCap c'\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (7 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; isUntypedCap c; map_to_ctes kh0H p' = Some (CTE c' n'); isUntypedCap c'; p = idle_tcb_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE c n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE c n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE c n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE c n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE c n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE c n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE c n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (9 subgoals):
 1. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<exists>d v0 v1 f. c' = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> False
 2. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<exists>d v0 v1 f. c' = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> False
 3. \<And>p p' c n c' n'. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. c = capability.UntypedCap d v0 v1 f; map_to_ctes kh0H p' = Some (CTE c' n'); \<exists>d v0 v1 f. c' = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE c n = the (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> False
 4. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 9. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (6 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> valid_nullcaps (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (6 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE capability.NullCap n)\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (6 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; p = idle_tcb_ptr \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE capability.NullCap n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE capability.NullCap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE capability.NullCap n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE capability.NullCap n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE capability.NullCap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE capability.NullCap n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE capability.NullCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE capability.NullCap n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE capability.NullCap n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE capability.NullCap n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> n = nullMDBNode
 2. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (8 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.NullCap n = the (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> n = MDB nullPointer nullPointer False False
 2. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.NullCap n = the (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> n = MDB nullPointer nullPointer False False
 3. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.NullCap n = the (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> n = MDB nullPointer nullPointer False False
 4. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 8. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> ut_revocable' (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE cap n); isUntypedCap cap\<rbrakk> \<Longrightarrow> mdbRevocable n
 2. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; isUntypedCap cap; p = idle_tcb_ptr \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE cap n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE cap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE cap n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE cap n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE cap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE cap n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE cap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE cap n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE cap n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE cap n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> mdbRevocable n
 2. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (7 subgoals):
 1. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE cap n = the (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n
 2. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE cap n = the (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n
 3. \<And>p cap n. \<lbrakk>1 \<le> maxDomain; \<exists>d v0 v1 f. cap = capability.UntypedCap d v0 v1 f; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE cap n = the (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n
 4. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 6. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 7. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (4 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> class_links (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; map_to_ctes kh0H p' = Some cte'; map_to_ctes kh0H \<turnstile> p \<leadsto> p'\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; map_to_ctes kh0H p' = Some cte'\<rbrakk> \<Longrightarrow> p' \<noteq> 0
 2. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; map_to_ctes kh0H p' = Some cte'; p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 3. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; p' = idle_tcb_ptr \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x10 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x20 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x30 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = idle_tcb_ptr + 0x40 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr \<and> cte' = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p' = Low_tcb_ptr + 0x10 \<and> cte' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p' = Low_tcb_ptr + 0x20 \<and> cte' = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = Low_tcb_ptr + 0x30 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = Low_tcb_ptr + 0x40 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr \<and> cte' = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p' = High_tcb_ptr + 0x10 \<and> cte' = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p' = High_tcb_ptr + 0x20 \<and> cte' = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p' = High_tcb_ptr + 0x30 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = High_tcb_ptr + 0x40 \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' = irq_cnode_ptr \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> irq_node_offs_range \<and> cte' = CTE capability.NullCap (MDB 0 0 False False) \<or> p' \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p' \<noteq> None \<and> cte' = the (Silc_cte_cte Silc_cnode_ptr p') \<or> p' \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p' \<noteq> None \<and> cte' = the (High_cte_cte High_cnode_ptr p') \<or> p' \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p' \<noteq> None \<and> cte' = the (Low_cte_cte Low_cnode_ptr p')\<rbrakk> \<Longrightarrow> p' \<noteq> 0
 2. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; map_to_ctes kh0H p' = Some cte'; p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 3. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (4 subgoals):
 1. \<And>p p' cte cte'. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some cte; map_to_ctes kh0H p' = Some cte'; p = Low_cnode_ptr + 0x13E0 \<and> p' = Silc_cnode_ptr + 0x13E0 \<or> p = Silc_cnode_ptr + 0x13E0 \<and> p' = High_cnode_ptr + 0x13E0 \<or> p = Low_tcb_ptr \<and> p' = Low_cnode_ptr + 0x20 \<or> p = Low_tcb_ptr + 0x10 \<and> p' = Low_cnode_ptr + 0x30 \<or> p = High_tcb_ptr \<and> p' = High_cnode_ptr + 0x20 \<or> p = High_tcb_ptr + 0x10 \<and> p' = High_cnode_ptr + 0x30\<rbrakk> \<Longrightarrow> capClass (cteCap cte) = capClass (cteCap cte')
 2. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 4. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (3 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> distinct_zombies (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (3 subgoals):
 1. \<And>ptr ptr' z za. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H ptr = Some z; ptr \<noteq> ptr'; map_to_ctes kh0H ptr' = Some za; isZombie (cteCap z); capClass (cteCap za) = PhysicalClass; \<not> isUntypedCap (cteCap za); \<not> isArchPageCap (cteCap za); capBits (cteCap z) = capBits (cteCap za); global.capUntypedPtr (cteCap z) = global.capUntypedPtr (cteCap za)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (3 subgoals):
 1. \<And>ptr ptr' z za. \<lbrakk>1 \<le> maxDomain; ptr \<noteq> ptr'; map_to_ctes kh0H ptr' = Some za; isZombie (cteCap z); capClass (cteCap za) = PhysicalClass; \<not> isUntypedCap (cteCap za); \<not> isArchPageCap (cteCap za); capBits (cteCap z) = capBits (cteCap za); global.capUntypedPtr (cteCap z) = global.capUntypedPtr (cteCap za); ptr = idle_tcb_ptr \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = idle_tcb_ptr + 0x10 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = idle_tcb_ptr + 0x20 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = idle_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = idle_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = Low_tcb_ptr \<and> z = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> ptr = Low_tcb_ptr + 0x10 \<and> z = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> ptr = Low_tcb_ptr + 0x20 \<and> z = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> ptr = Low_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = Low_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = High_tcb_ptr \<and> z = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> ptr = High_tcb_ptr + 0x10 \<and> z = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> ptr = High_tcb_ptr + 0x20 \<and> z = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> ptr = High_tcb_ptr + 0x30 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = High_tcb_ptr + 0x40 \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr = irq_cnode_ptr \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr \<in> irq_node_offs_range \<and> z = CTE capability.NullCap (MDB 0 0 False False) \<or> ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr ptr \<noteq> None \<and> z = the (Silc_cte_cte Silc_cnode_ptr ptr) \<or> ptr \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr ptr \<noteq> None \<and> z = the (High_cte_cte High_cnode_ptr ptr) \<or> ptr \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr ptr \<noteq> None \<and> z = the (Low_cte_cte Low_cnode_ptr ptr)\<rbrakk> \<Longrightarrow> False
 2. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 3. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (5 subgoals):
 1. \<And>ptr ptr' za. \<lbrakk>1 \<le> maxDomain; ptr \<noteq> ptr'; map_to_ctes kh0H ptr' = Some za; \<exists>v0 v1 v2. cteCap (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.Zombie v0 v1 v2; capClass (cteCap za) = PhysicalClass; \<forall>d v0 v1 f. cteCap za \<noteq> capability.UntypedCap d v0 v1 f; \<forall>d ref rghts sz data. cteCap za \<noteq> capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data); capBits (cteCap (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = capBits (cteCap za); global.capUntypedPtr (cteCap (the (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = global.capUntypedPtr (cteCap za); ptr \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Silc_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> False
 2. \<And>ptr ptr' za. \<lbrakk>1 \<le> maxDomain; ptr \<noteq> ptr'; map_to_ctes kh0H ptr' = Some za; \<exists>v0 v1 v2. cteCap (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.Zombie v0 v1 v2; capClass (cteCap za) = PhysicalClass; \<forall>d v0 v1 f. cteCap za \<noteq> capability.UntypedCap d v0 v1 f; \<forall>d ref rghts sz data. cteCap za \<noteq> capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data); capBits (cteCap (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = capBits (cteCap za); global.capUntypedPtr (cteCap (the (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = global.capUntypedPtr (cteCap za); ptr \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> High_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> False
 3. \<And>ptr ptr' za. \<lbrakk>1 \<le> maxDomain; ptr \<noteq> ptr'; map_to_ctes kh0H ptr' = Some za; \<exists>v0 v1 v2. cteCap (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.Zombie v0 v1 v2; capClass (cteCap za) = PhysicalClass; \<forall>d v0 v1 f. cteCap za \<noteq> capability.UntypedCap d v0 v1 f; \<forall>d ref rghts sz data. cteCap za \<noteq> capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data); capBits (cteCap (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = capBits (cteCap za); global.capUntypedPtr (cteCap (the (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))) = global.capUntypedPtr (cteCap za); ptr \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned ptr cte_level_bits \<and> Low_cnode_ptr \<le> ptr \<and> ptr \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (ptr - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> False
 4. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 5. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (2 subgoals):
 1. 1 \<le> maxDomain \<Longrightarrow> irq_control (map_to_ctes kh0H)
 2. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (2 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H p = Some (CTE capability.IRQControlCap n)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. map_to_ctes kh0H p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p)
 2. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (2 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; p = idle_tcb_ptr \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x10 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x20 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x30 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = idle_tcb_ptr + 0x40 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr \<and> CTE capability.IRQControlCap n = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> p = Low_tcb_ptr + 0x10 \<and> CTE capability.IRQControlCap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> p = Low_tcb_ptr + 0x20 \<and> CTE capability.IRQControlCap n = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> p = Low_tcb_ptr + 0x30 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = Low_tcb_ptr + 0x40 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr \<and> CTE capability.IRQControlCap n = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> p = High_tcb_ptr + 0x10 \<and> CTE capability.IRQControlCap n = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> p = High_tcb_ptr + 0x20 \<and> CTE capability.IRQControlCap n = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> p = High_tcb_ptr + 0x30 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = High_tcb_ptr + 0x40 \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p = irq_cnode_ptr \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> irq_node_offs_range \<and> CTE capability.IRQControlCap n = CTE capability.NullCap (MDB 0 0 False False) \<or> p \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr p \<noteq> None \<and> CTE capability.IRQControlCap n = the (Silc_cte_cte Silc_cnode_ptr p) \<or> p \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr p \<noteq> None \<and> CTE capability.IRQControlCap n = the (High_cte_cte High_cnode_ptr p) \<or> p \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr p \<noteq> None \<and> CTE capability.IRQControlCap n = the (Low_cte_cte Low_cnode_ptr p)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. map_to_ctes kh0H p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p)
 2. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (4 subgoals):
 1. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.IRQControlCap n = the (if is_aligned p cte_level_bits \<and> Silc_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. map_to_ctes kh0H p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p)
 2. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.IRQControlCap n = the (if is_aligned p cte_level_bits \<and> High_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. map_to_ctes kh0H p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p)
 3. \<And>p n. \<lbrakk>1 \<le> maxDomain; p \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y) \<and> CTE capability.IRQControlCap n = the (if is_aligned p cte_level_bits \<and> Low_cnode_ptr \<le> p \<and> p \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (p - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)\<rbrakk> \<Longrightarrow> mdbRevocable n \<and> (\<forall>p'. (\<exists>n'. map_to_ctes kh0H p' = Some (CTE capability.IRQControlCap n')) \<longrightarrow> p' = p)
 4. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (1 subgoal):
 1. 1 \<le> maxDomain \<Longrightarrow> reply_masters_rvk_fb (map_to_ctes kh0H) proof (prove)
goal (1 subgoal):
 1. \<And>cte a. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = Some cte; isReplyCap (cteCap cte); capReplyMaster (cteCap cte)\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (1 subgoal):
 1. \<And>cte a. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = Some cte; isReplyCap (cteCap cte); capReplyMaster (cteCap cte); a = idle_tcb_ptr \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x10 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x20 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = idle_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = Low_tcb_ptr \<and> cte = CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB (Low_cnode_ptr + 0x20) 0 False False) \<or> a = Low_tcb_ptr + 0x10 \<and> cte = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB (Low_cnode_ptr + 0x30) 0 False False) \<or> a = Low_tcb_ptr + 0x20 \<and> cte = CTE (capability.ReplyCap Low_tcb_ptr True True) (MDB 0 0 True True) \<or> a = Low_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = Low_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = High_tcb_ptr \<and> cte = CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB (High_cnode_ptr + 0x20) 0 False False) \<or> a = High_tcb_ptr + 0x10 \<and> cte = CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB (High_cnode_ptr + 0x30) 0 False False) \<or> a = High_tcb_ptr + 0x20 \<and> cte = CTE (capability.ReplyCap High_tcb_ptr True True) (MDB 0 0 True True) \<or> a = High_tcb_ptr + 0x30 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = High_tcb_ptr + 0x40 \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a = irq_cnode_ptr \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a \<in> irq_node_offs_range \<and> cte = CTE capability.NullCap (MDB 0 0 False False) \<or> a \<in> cnode_offs_range Silc_cnode_ptr \<and> Silc_cte_cte Silc_cnode_ptr a \<noteq> None \<and> cte = the (Silc_cte_cte Silc_cnode_ptr a) \<or> a \<in> cnode_offs_range High_cnode_ptr \<and> High_cte_cte High_cnode_ptr a \<noteq> None \<and> cte = the (High_cte_cte High_cnode_ptr a) \<or> a \<in> cnode_offs_range Low_cnode_ptr \<and> Low_cte_cte Low_cnode_ptr a \<noteq> None \<and> cte = the (Low_cte_cte Low_cnode_ptr a)\<rbrakk> \<Longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte) proof (prove)
goal (3 subgoals):
 1. \<And>a. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); \<exists>v0 v1 v2. cteCap (the (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.ReplyCap v0 v1 v2; capReplyMaster (cteCap (the (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))); a \<in> cnode_offs_range Silc_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> Silc_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Silc_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (High_cnode_ptr + 0x13E0) (Low_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Silc_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Silc_cnode_ptr 10 2 10) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> (Silc_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + Silc_cnode_ptr) \<and> ((Silc_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + Silc_cnode_ptr) \<longrightarrow> mdbRevocable (cteMDBNode (the None)) \<and> mdbFirstBadged (cteMDBNode (the None)))
 2. \<And>a. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); \<exists>v0 v1 v2. cteCap (the (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.ReplyCap v0 v1 v2; capReplyMaster (cteCap (the (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))); a \<in> cnode_offs_range High_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> High_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + High_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 False True) (MDB 0 (Silc_cnode_ptr + 0x13E0) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap High_pd_ptr (Some High_asid))) (MDB 0 (High_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap High_cnode_ptr 10 2 10) (MDB 0 High_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - High_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap High_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> (High_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + High_cnode_ptr) \<and> ((High_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + High_cnode_ptr) \<longrightarrow> mdbRevocable (cteMDBNode (the None)) \<and> mdbFirstBadged (cteMDBNode (the None)))
 3. \<And>a. \<lbrakk>1 \<le> maxDomain; map_to_ctes kh0H a = (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None); \<exists>v0 v1 v2. cteCap (the (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None)) = capability.ReplyCap v0 v1 v2; capReplyMaster (cteCap (the (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None))); a \<in> cnode_offs_range Low_cnode_ptr \<and> (\<exists>y. (if is_aligned a cte_level_bits \<and> Low_cnode_ptr \<le> a \<and> a \<le> 0x3FFF + Low_cnode_ptr then if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 318 then Some (CTE (capability.NotificationCap ntfn_ptr 0 True False) (MDB (Silc_cnode_ptr + 0x13E0) 0 False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 3 then Some (CTE (capability.ArchObjectCap (arch_capability.PageDirectoryCap Low_pd_ptr (Some Low_asid))) (MDB 0 (Low_tcb_ptr + 0x10) False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 2 then Some (CTE (capability.CNodeCap Low_cnode_ptr 10 2 10) (MDB 0 Low_tcb_ptr False False)) else if to_bl (UCAST(32 \<rightarrow> 10) (a - Low_cnode_ptr >> cte_level_bits)) = the_nat_to_bl 10 (Suc 0) then Some (CTE (capability.ThreadCap Low_tcb_ptr) (MDB 0 0 False False)) else Some (CTE capability.NullCap (MDB 0 0 False False)) else None) = Some y)\<rbrakk> \<Longrightarrow> (Low_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + Low_cnode_ptr) \<and> ((Low_cnode_ptr \<le> a \<longrightarrow> is_aligned a cte_level_bits \<longrightarrow> \<not> a \<le> 0x3FFF + Low_cnode_ptr) \<longrightarrow> mdbRevocable (cteMDBNode (the None)) \<and> mdbFirstBadged (cteMDBNode (the None))) proof (prove)
goal:
No subgoals!