theory CNodeInv_R

lemma make_zombie_invs':
  "\<lbrace>\<lambda>s. invs' s \<and> s \<turnstile>' cap \<and>
    cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and>
    cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and>
                      capUntypedPtr (cteCap cte) = capUntypedPtr cap \<and>
                      capBits (cteCap cte) = capBits cap \<and>
                      (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s).
                        cte_wp_at' (\<lambda>cte. cteCap cte = NullCap) r s) \<and>
                      (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and>
                      final_matters' (cteCap cte) \<and>
                      (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte)
                         \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and>
                      (\<forall>p \<in> threadCapRefs (cteCap cte).
                            st_tcb_at' ((=) Inactive) p s
                             \<and> bound_tcb_at' ((=) None) p s
                             \<and> obj_at' (Not \<circ> tcbQueued) p s
                             \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s\<rbrace>
    updateCap sl cap
  \<lbrace>\<lambda>rv. invs'\<rbrace>" apply (simp add: invs'_def valid_state'_def valid_pspace'_def valid_mdb'_def
                   valid_irq_handlers'_def irq_issued'_def) apply (wp updateCap_ctes_of_wp sch_act_wf_lift valid_queues_lift cur_tcb_lift
            updateCap_iflive' updateCap_ifunsafe' updateCap_idle'
            valid_arch_state_lift' valid_irq_node_lift ct_idle_or_in_cur_domain'_lift2
            updateCap_untyped_ranges_zero_simple
       | simp)+ apply clarsimp apply (intro conjI[rotated]) apply (clarsimp simp: cte_wp_at_ctes_of) apply (auto simp: untypedZeroRange_def isCap_simps)[1] apply (clarsimp simp: modify_map_def ran_def split del: if_split
                     split: if_split_asm) apply (clarsimp simp: cteCaps_of_def cte_wp_at_ctes_of isCap_simps) apply auto[1] apply (clarsimp simp: disj_comms cte_wp_at_ctes_of
                    dest!: ztc_phys capBits_capUntyped_capRange) apply (frule(1) capBits_capUntyped_capRange, simp) apply (clarsimp dest!: valid_global_refsD_with_objSize) apply (clarsimp simp: disj_comms cte_wp_at_ctes_of
                    dest!: ztc_phys capBits_capUntyped_capRange) apply (frule(1) capBits_capUntyped_capRange, simp) apply (clarsimp dest!: valid_global_refsD_with_objSize) apply (auto elim: if_unsafe_then_capD' simp: isCap_simps)[1] apply (clarsimp simp: cte_wp_at_ctes_of) apply (drule bspec[where x=sl], simp) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: cte_wp_at_ctes_of) apply (subgoal_tac "st_tcb_at' ((=) Inactive) p' s
                               \<and> obj_at' (Not \<circ> tcbQueued) p' s
                               \<and> bound_tcb_at' ((=) None) p' s") apply (clarsimp simp: pred_tcb_at'_def obj_at'_def ko_wp_at'_def projectKOs) apply (auto dest!: isCapDs)[1] apply (clarsimp simp: cte_wp_at_ctes_of disj_ac
                 dest!: isCapDs) apply (frule ztc_phys[where cap=cap]) apply (frule(1) capBits_capUntyped_capRange, simp) apply (case_tac cte) apply clarsimp apply (simp add: valid_mdb_ctes_def) apply (rule conjI) apply (subst modify_map_dlist_iff) apply (case_tac cte, simp) apply simp apply (rule conjI) apply (rule mdb_chain_0_modify_map_inv, simp) apply simp apply (rule conjI) apply (clarsimp simp: modify_map_apply) apply (simp add: valid_badges_def del: fun_upd_apply) apply clarify apply (thin_tac "\<not> isUntypedCap cap" for cap) apply (clarsimp simp: isCap_simps split: if_split_asm) subgoal by ((elim disjE | clarsimp simp: isCap_simps)+) subgoal by (fastforce simp: isCap_simps sameRegionAs_def3) apply (clarsimp simp: mdb_next_unfold) apply (erule_tac x=p in allE) apply (erule_tac x="mdbNext node" in allE) subgoal by simp apply (rule conjI) apply clarsimp apply (erule (1) caps_contained_subrange, simp) subgoal by (clarsimp simp: isCap_simps) apply (clarsimp simp add: isCap_simps) apply (subgoal_tac "valid_mdb' s") prefer 2 apply (simp add: valid_mdb'_def valid_mdb_ctes_def) apply (rule conjI) defer apply (cut_tac m="ctes_of s"
            and m'="(modify_map (ctes_of s) sl
                       (cteCap_update (\<lambda>_. cap)))"
                in descendants_of_subset_untyped) apply (clarsimp simp: modify_map_def) apply (rule conjI, clarsimp simp: isCap_simps) apply clarsimp apply (simp only: modify_map_apply) apply (rule use_update_ztc_two [OF descendants_of_update_ztc]) apply (rule exEI, rule vmdb.isFinal_untypedParent) apply (rule vmdb.intro, simp add: valid_mdb'_def) apply assumption apply (simp add: cteCaps_of_def) apply (clarsimp simp: isCap_simps) apply assumption apply (clarsimp simp: isCap_simps) apply assumption apply (simp add: disj_comms) apply (simp add: capRange_def) apply (simp add: capRange_def) apply (rule valid_capAligned) apply (erule(1) ctes_of_valid') apply (simp add: disj_comms) apply clarsimp apply (erule(1) mdb_chain_0_no_loops) apply (erule (3) isFinal_no_descendants) apply (clarsimp simp: modify_map_apply) apply (rule conjI, clarsimp simp: valid_nullcaps_def isCap_simps) apply (rule conjI, clarsimp simp: ut_revocable'_def isCap_simps) apply (rule conjI, clarsimp elim!: class_links_update) apply (rule conjI) apply (erule(1) distinct_zombies_seperate_if_zombiedE) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: isCap_simps) apply simp apply simp apply simp apply (erule_tac sl'=y in Final_notUntyped_capRange_disjoint,
           simp add: cteCaps_of_def,
           simp_all add: disj_ac)[1] apply (erule(1) ctes_of_valid_cap') apply (rule conjI) apply (subgoal_tac "cap \<noteq> IRQControlCap") apply (clarsimp simp: irq_control_def) apply (clarsimp simp: isCap_simps) apply (simp add: reply_masters_rvk_fb_def, erule ball_ran_fun_updI) apply (clarsimp simp: isCap_simps) apply (clarsimp simp: modify_map_apply) apply (erule(1) ztc_replace_update_final, simp_all) apply (simp add: cteCaps_of_def) apply (erule(1) ctes_of_valid_cap') done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. invs' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>pr. p \<notin> set (ksReadyQueues s pr)))) sl s\<rbrace> updateCap sl cap \<lbrace>\<lambda>rv. invs'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s. valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_mdb_ctes (ctes_of s) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> (\<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrace> updateCap sl cap \<lbrace>\<lambda>rv. (\<lambda>s. valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_mdb_ctes (ctes_of s) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> (\<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s) and cur_tcb'\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. valid_objs' s \<and> pspace_aligned' s \<and> pspace_distinct' s \<and> no_0_obj' s \<and> valid_mdb_ctes (ctes_of s) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> sym_refs (state_refs_of' s) \<and> if_live_then_nonz_cap' s \<and> if_unsafe_then_cap' s \<and> valid_idle' s \<and> valid_global_refs' s \<and> valid_arch_state' s \<and> valid_irq_node' (irq_node' s) s \<and> (\<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<and> valid_irq_states' s \<and> valid_machine_state' s \<and> irqs_masked' s \<and> valid_queues' s \<and> ct_not_inQ s \<and> ct_idle_or_in_cur_domain' s \<and> valid_pde_mappings' s \<and> pspace_domain_valid s \<and> ksCurDomain s \<le> maxDomain \<and> ksDomSchedule s \<noteq> [] \<and> (\<forall>x\<in>set (ksDomSchedule s). dschDomain x \<le> maxDomain \<and> 0 < dschLength x) \<and> ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined) \<and> ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)) \<and> untyped_ranges_zero' s \<and> cur_tcb' s \<and> valid_cap' cap s \<and> cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s \<and> cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s \<and> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s \<and> (cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> kernel_data_refs \<inter> capRange cap = {} \<and> 2 ^ capBits cap \<le> gsMaxObjectSize s \<and> (\<forall>cap\<in>ran (modify_map (cteCaps_of s) sl (\<lambda>y. cap)). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<and> ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> [] \<and> cte_wp_at' ((\<lambda>cp. untypedZeroRange cp = untypedZeroRange cap) \<circ> cteCap) sl s proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s \<and> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s \<and> (cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s) \<and> kernel_data_refs \<inter> capRange cap = {} \<and> 2 ^ capBits cap \<le> gsMaxObjectSize s \<and> (\<forall>cap\<in>ran (modify_map (cteCaps_of s) sl (\<lambda>y. cap)). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal) \<and> cte_wp_at' ((\<lambda>cp. untypedZeroRange cp = untypedZeroRange cap) \<circ> cteCap) sl s proof (prove)
goal (8 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' ((\<lambda>cp. untypedZeroRange cp = untypedZeroRange cap) \<circ> cteCap) sl s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> \<forall>cap\<in>ran (modify_map (cteCaps_of s) sl (\<lambda>y. cap)). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 7. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 8. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b)))\<rbrakk> \<Longrightarrow> untypedZeroRange (cteCap cte) = untypedZeroRange cap
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> \<forall>cap\<in>ran (modify_map (cteCaps_of s) sl (\<lambda>y. cap)). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 7. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 8. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> \<forall>cap\<in>ran (modify_map (cteCaps_of s) sl (\<lambda>y. cap)). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 7. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s irq z. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap. (\<exists>a. cteCaps_of s a = Some cap) \<longrightarrow> (\<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal); valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' (capability.IRQHandlerCap irq) s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr (capability.IRQHandlerCap irq) \<and> capBits (cteCap cte) = 0 \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - {irq_node' s + UCAST(10 \<rightarrow> 32) irq * 0x10}. cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie (capability.IRQHandlerCap irq) \<or> isThreadCap (capability.IRQHandlerCap irq) \<or> isCNodeCap (capability.IRQHandlerCap irq)) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s; cap = capability.IRQHandlerCap irq; cteCaps_of s sl = Some z\<rbrakk> \<Longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 2. \<And>s a irq. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap. (\<exists>a. cteCaps_of s a = Some cap) \<longrightarrow> (\<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal); valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s; a \<noteq> sl; cteCaps_of s a = Some (capability.IRQHandlerCap irq)\<rbrakk> \<Longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 7. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 8. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s a irq. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap. (\<exists>a. cteCaps_of s a = Some cap) \<longrightarrow> (\<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal); valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s; a \<noteq> sl; cteCaps_of s a = Some (capability.IRQHandlerCap irq)\<rbrakk> \<Longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 7. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; capClass cap = PhysicalClass; final_matters' (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b)))\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; capClass cap = PhysicalClass; final_matters' (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capRange (cteCap cte) = capRange cap\<rbrakk> \<Longrightarrow> 2 ^ capBits cap \<le> gsMaxObjectSize s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 6. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; capClass cap = PhysicalClass; final_matters' (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b)))\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; capClass cap = PhysicalClass; final_matters' (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capRange (cteCap cte) = capRange cap\<rbrakk> \<Longrightarrow> kernel_data_refs \<inter> capRange cap = {}
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 5. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cap \<noteq> capability.NullCap \<longrightarrow> ex_cte_cap_wp_to' (\<lambda>_. True) sl s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 4. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte. \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s \<and> (r = sl \<longrightarrow> cap = capability.NullCap)) sl s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); sl \<in> cte_refs' (cteCap cte) (irq_node' s); sl \<notin> cte_refs' cap (irq_node' s)\<rbrakk> \<Longrightarrow> cap = capability.NullCap
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); sl \<in> cte_refs' (cteCap cte) (irq_node' s); sl \<notin> cte_refs' cap (irq_node' s); \<exists>cte. ctes_of s sl = Some cte \<and> cteCap cte = capability.NullCap\<rbrakk> \<Longrightarrow> cap = capability.NullCap
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>cte'. \<forall>p'\<in>zobj_refs' (cteCap cte') - zobj_refs' cap. ko_wp_at' (Not \<circ> live') p' s) sl s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s cte p'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); p' \<in> zobj_refs' (cteCap cte); p' \<notin> zobj_refs' cap\<rbrakk> \<Longrightarrow> ko_wp_at' (Not \<circ> live') p' s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s cte p'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); p' \<in> zobj_refs' (cteCap cte); p' \<notin> zobj_refs' cap; st_tcb_at' ((=) Structures_H.thread_state.Inactive) p' s \<and> obj_at' (Not \<circ> tcbQueued) p' s \<and> bound_tcb_at' ((=) None) p' s\<rbrakk> \<Longrightarrow> ko_wp_at' (Not \<circ> live') p' s
 2. \<And>s cte p'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); p' \<in> zobj_refs' (cteCap cte); p' \<notin> zobj_refs' cap\<rbrakk> \<Longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Inactive) p' s \<and> obj_at' (Not \<circ> tcbQueued) p' s \<and> bound_tcb_at' ((=) None) p' s
 3. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s cte p'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap; final_matters' (cteCap cte); isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); p' \<in> zobj_refs' (cteCap cte); p' \<notin> zobj_refs' cap\<rbrakk> \<Longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Inactive) p' s \<and> obj_at' (Not \<circ> tcbQueued) p' s \<and> bound_tcb_at' ((=) None) p' s
 2. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; cte_wp_at' (\<lambda>cte. isFinal (cteCap cte) sl (cteCaps_of s)) sl s; cte_wp_at' (\<lambda>cte. capClass (cteCap cte) = PhysicalClass \<and> global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap \<and> capBits (cteCap cte) = capBits cap \<and> (\<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). cte_wp_at' (\<lambda>cte. cteCap cte = capability.NullCap) r s) \<and> (isZombie cap \<or> isThreadCap cap \<or> isCNodeCap cap) \<and> final_matters' (cteCap cte) \<and> (isThreadCap (cteCap cte) \<or> isCNodeCap (cteCap cte) \<or> isZombie (cteCap cte)) \<and> \<not> isUntypedCap (cteCap cte) \<and> (\<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))))) sl s\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' (cteCap cte); isCNodeCap (cteCap cte) \<or> isThreadCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b)))\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' (cteCap cte); isCNodeCap (cteCap cte) \<or> isThreadCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' (cteCap cte); isCNodeCap (cteCap cte) \<or> isThreadCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange (cteCap cte) = capRange cap\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s cte x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal (cteCap cte) sl (cteCaps_of s); ctes_of s sl = Some cte; capClass (cteCap cte) = PhysicalClass; global.capUntypedPtr (cteCap cte) = global.capUntypedPtr cap; capBits (cteCap cte) = capBits cap; \<forall>r\<in>cte_refs' (cteCap cte) (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' (cteCap cte); isCNodeCap (cteCap cte) \<or> isThreadCap (cteCap cte) \<or> isZombie (cteCap cte); \<not> isUntypedCap (cteCap cte); \<forall>p\<in>threadCapRefs (cteCap cte). st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange (cteCap cte) = capRange cap; cte = CTE x1 x2\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_mdb_ctes (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_mdb_ctes (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_dlist (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_dlist (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> cteMDBNode (cteCap_update (\<lambda>_. cap) cte) = cteMDBNode cte
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_dlist (ctes_of s)
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chain_0 (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 cte. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdbNext (cteMDBNode (cteCap_update (\<lambda>_. cap) cte)) = mdbNext (cteMDBNode cte)
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_badges (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_badges ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>p p' capa. (\<exists>node. ((ctes_of s)(sl \<mapsto> CTE cap x2)) p = Some (CTE capa node)) \<longrightarrow> (\<forall>cap' node'. ((ctes_of s)(sl \<mapsto> CTE cap x2)) p' = Some (CTE cap' node') \<longrightarrow> (ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs capa cap' \<longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p p' capa node cap' node'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(sl \<mapsto> CTE cap x2)) p = Some (CTE capa node); ((ctes_of s)(sl \<mapsto> CTE cap x2)) p' = Some (CTE cap' node'); (ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p p' capa node cap' node'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> (isEndpointCap cap \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap cap \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ((ctes_of s)(sl \<mapsto> CTE cap x2)) p = Some (CTE capa node); ((ctes_of s)(sl \<mapsto> CTE cap x2)) p' = Some (CTE cap' node'); (ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'\<rbrakk> \<Longrightarrow> (isEndpointCap capa \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> (isNotificationCap capa \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 p' cap' node'. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> sl \<leadsto> p'; global.sameRegionAs cap cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p' \<noteq> sl; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2 p capa node. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> sl; global.sameRegionAs capa cap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node)\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 3. \<And>s x1 x2 p p' capa node cap' node'. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); p' \<noteq> sl; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ctes_of s_)(sl \<mapsto> CTE cap x2_) \<turnstile> sl \<leadsto> p'_; global.sameRegionAs cap cap'_; valid_objs' s_; pspace_aligned' s_; pspace_distinct' s_; no_0_obj' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; sym_refs (state_refs_of' s_); if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; \<forall>cap\<in>ran (cteCaps_of s_). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s_) irq = irqstate.IRQSignal; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; valid_cap' cap s_; isFinal x1_ sl (cteCaps_of s_); ctes_of s_ sl = Some (CTE x1_ x2_); capClass x1_ = PhysicalClass; global.capUntypedPtr x1_ = global.capUntypedPtr cap; capBits x1_ = capBits cap; \<forall>r\<in>cte_refs' x1_ (irq_node' s_) - cte_refs' cap (irq_node' s_). \<exists>cte. ctes_of s_ r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1_; (\<exists>v0 v1 v2 v3. x1_ = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1_ = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1_ = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1_. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s_ \<and> bound_tcb_at' ((=) None) p s_ \<and> obj_at' (Not \<circ> tcbQueued) p s_ \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s_ (a, b))); capClass cap = PhysicalClass; capRange x1_ = capRange cap; valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); \<forall>p p' cap. (\<exists>node. ctes_of s_ p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s_ p' = Some (CTE cap' node') \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); p'_ \<noteq> sl; ctes_of s_ p'_ = Some (CTE cap'_ node'_)\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap'_ \<longrightarrow> capEPBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap'_ \<longrightarrow> capNtfnBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 p capa node. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> sl; global.sameRegionAs capa cap; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node)\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2) \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2)
 2. \<And>s x1 x2 p p' capa node cap' node'. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); p' \<noteq> sl; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(ctes_of s_)(sl \<mapsto> CTE cap x2_) \<turnstile> p_ \<leadsto> sl; global.sameRegionAs capa_ cap; valid_objs' s_; pspace_aligned' s_; pspace_distinct' s_; no_0_obj' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; sym_refs (state_refs_of' s_); if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; \<forall>cap\<in>ran (cteCaps_of s_). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s_) irq = irqstate.IRQSignal; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; valid_cap' cap s_; isFinal x1_ sl (cteCaps_of s_); ctes_of s_ sl = Some (CTE x1_ x2_); capClass x1_ = PhysicalClass; global.capUntypedPtr x1_ = global.capUntypedPtr cap; capBits x1_ = capBits cap; \<forall>r\<in>cte_refs' x1_ (irq_node' s_) - cte_refs' cap (irq_node' s_). \<exists>cte. ctes_of s_ r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1_; (\<exists>v0 v1 v2 v3. x1_ = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1_ = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1_ = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1_. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s_ \<and> bound_tcb_at' ((=) None) p s_ \<and> obj_at' (Not \<circ> tcbQueued) p s_ \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s_ (a, b))); capClass cap = PhysicalClass; capRange x1_ = capRange cap; valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); \<forall>p p' cap. (\<exists>node. ctes_of s_ p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s_ p' = Some (CTE cap' node') \<longrightarrow> ctes_of s_ \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); p_ \<noteq> sl; ctes_of s_ p_ = Some (CTE capa_ node_)\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa_ = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa_ \<noteq> capEPBadge cap \<longrightarrow> capEPBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2_) \<and> ((\<exists>v0 v1 v2 v3. capa_ = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa_ \<noteq> capNtfnBadge cap \<longrightarrow> capNtfnBadge cap \<noteq> 0 \<longrightarrow> mdbFirstBadged x2_) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p p' capa node cap' node'. \<lbrakk>(ctes_of s)(sl \<mapsto> CTE cap x2) \<turnstile> p \<leadsto> p'; global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> ctes_of s \<turnstile> p \<leadsto> p' \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); p' \<noteq> sl; ctes_of s p' = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p capa node cap' node'. \<lbrakk>global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); \<forall>p p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> (\<exists>z. ctes_of s p = Some z \<and> p' = mdbNext (cteMDBNode z)) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); mdbNext node \<noteq> sl; ctes_of s (mdbNext node) = Some (CTE cap' node')\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p capa node cap' node'. \<lbrakk>global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); mdbNext node \<noteq> sl; ctes_of s (mdbNext node) = Some (CTE cap' node'); \<forall>p' cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s p' = Some (CTE cap' node') \<longrightarrow> (\<exists>z. ctes_of s p = Some z \<and> p' = mdbNext (cteMDBNode z)) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2 p capa node cap' node'. \<lbrakk>global.sameRegionAs capa cap'; valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1; (\<exists>v0 v1 v2 v3. x1 = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1 = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1 = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); p \<noteq> sl; ctes_of s p = Some (CTE capa node); mdbNext node \<noteq> sl; ctes_of s (mdbNext node) = Some (CTE cap' node'); \<forall>cap. (\<exists>node. ctes_of s p = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s (mdbNext node) = Some (CTE cap' node') \<longrightarrow> (\<exists>z. ctes_of s p = Some z \<and> mdbNext node = mdbNext (cteMDBNode z)) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. capa = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node')
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>global.sameRegionAs capa_ cap'_; valid_objs' s_; pspace_aligned' s_; pspace_distinct' s_; no_0_obj' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; sym_refs (state_refs_of' s_); if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; \<forall>cap\<in>ran (cteCaps_of s_). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s_) irq = irqstate.IRQSignal; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; valid_cap' cap s_; isFinal x1_ sl (cteCaps_of s_); ctes_of s_ sl = Some (CTE x1_ x2_); capClass x1_ = PhysicalClass; global.capUntypedPtr x1_ = global.capUntypedPtr cap; capBits x1_ = capBits cap; \<forall>r\<in>cte_refs' x1_ (irq_node' s_) - cte_refs' cap (irq_node' s_). \<exists>cte. ctes_of s_ r = Some cte \<and> cteCap cte = capability.NullCap; (\<exists>v0 v1 v2 v3. cap = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. cap = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. cap = capability.Zombie v0 v1 v2); final_matters' x1_; (\<exists>v0 v1 v2 v3. x1_ = capability.CNodeCap v0 v1 v2 v3) \<or> (\<exists>v0. x1_ = capability.ThreadCap v0) \<or> (\<exists>v0 v1 v2. x1_ = capability.Zombie v0 v1 v2); \<forall>p\<in>threadCapRefs x1_. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s_ \<and> bound_tcb_at' ((=) None) p s_ \<and> obj_at' (Not \<circ> tcbQueued) p s_ \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s_ (a, b))); capClass cap = PhysicalClass; capRange x1_ = capRange cap; valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); caps_contained' (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_); p_ \<noteq> sl; ctes_of s_ p_ = Some (CTE capa_ node_); mdbNext node_ \<noteq> sl; ctes_of s_ (mdbNext node_) = Some (CTE cap'_ node'_); \<forall>cap. (\<exists>node. ctes_of s_ p_ = Some (CTE cap node)) \<longrightarrow> (\<forall>cap' node'. ctes_of s_ (mdbNext node_) = Some (CTE cap' node') \<longrightarrow> (\<exists>z. ctes_of s_ p_ = Some z \<and> mdbNext node_ = mdbNext (cteMDBNode z)) \<longrightarrow> global.sameRegionAs cap cap' \<longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. cap = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge cap \<noteq> capEPBadge cap' \<longrightarrow> capEPBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node') \<and> ((\<exists>v0 v1 v2 v3. cap = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge cap \<noteq> capNtfnBadge cap' \<longrightarrow> capNtfnBadge cap' \<noteq> 0 \<longrightarrow> mdbFirstBadged node'))\<rbrakk> \<Longrightarrow> ((\<exists>v0 v1 v2 v3 v4 v5. capa_ = capability.EndpointCap v0 v1 v2 v3 v4 v5) \<longrightarrow> capEPBadge capa_ \<noteq> capEPBadge cap'_ \<longrightarrow> capEPBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) \<and> ((\<exists>v0 v1 v2 v3. capa_ = capability.NotificationCap v0 v1 v2 v3) \<longrightarrow> capNtfnBadge capa_ \<noteq> capNtfnBadge cap'_ \<longrightarrow> capNtfnBadge cap'_ \<noteq> 0 \<longrightarrow> mdbFirstBadged node'_) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> caps_contained' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<not> isUntypedCap x1
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<not> isUntypedCap cap
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>valid_objs' s_; pspace_aligned' s_; pspace_distinct' s_; no_0_obj' s_; sch_act_wf (ksSchedulerAction s_) s_; Invariants_H.valid_queues s_; sym_refs (state_refs_of' s_); if_live_then_nonz_cap' s_; if_unsafe_then_cap' s_; valid_idle' s_; valid_global_refs' s_; valid_arch_state' s_; valid_irq_node' (irq_node' s_) s_; \<forall>cap\<in>ran (cteCaps_of s_). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s_) irq = irqstate.IRQSignal; valid_irq_states' s_; valid_machine_state' s_; irqs_masked' s_; valid_queues' s_; ct_not_inQ s_; ct_idle_or_in_cur_domain' s_; valid_pde_mappings' s_; pspace_domain_valid s_; ksCurDomain s_ \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s_ = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s_ < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s_; cur_tcb' s_; valid_cap' cap s_; isFinal x1_ sl (cteCaps_of s_); ctes_of s_ sl = Some (CTE x1_ x2_); capClass x1_ = PhysicalClass; global.capUntypedPtr x1_ = global.capUntypedPtr cap; capBits x1_ = capBits cap; \<forall>r\<in>cte_refs' x1_ (irq_node' s_) - cte_refs' cap (irq_node' s_). \<exists>cte. ctes_of s_ r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1_; isCNodeCap x1_ \<or> isThreadCap x1_ \<or> isZombie x1_; \<not> isUntypedCap x1_; \<forall>p\<in>threadCapRefs x1_. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s_ \<and> bound_tcb_at' ((=) None) p s_ \<and> obj_at' (Not \<circ> tcbQueued) p s_ \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s_ (a, b))); capClass cap = PhysicalClass; capRange x1_ = capRange cap; valid_dlist (ctes_of s_); no_0 (ctes_of s_); mdb_chain_0 (ctes_of s_); valid_badges (ctes_of s_); mdb_chunked (ctes_of s_); untyped_mdb' (ctes_of s_); untyped_inc' (ctes_of s_); valid_nullcaps (ctes_of s_); ut_revocable' (ctes_of s_); class_links (ctes_of s_); distinct_zombies (ctes_of s_); irq_control (ctes_of s_); reply_masters_rvk_fb (ctes_of s_)\<rbrakk> \<Longrightarrow> \<not> isUntypedCap x1_ proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> \<not> isUntypedCap cap
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_mdb' s proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap\<rbrakk> \<Longrightarrow> valid_mdb' s
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> (ctes_of s x = None) = (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)) x = None) \<and> (\<forall>cte cte'. ctes_of s x = Some cte \<and> modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)) x = Some cte' \<longrightarrow> isUntypedCap (cteCap cte) = isUntypedCap (cteCap cte') \<and> capRange (cteCap cte) = capRange (cteCap cte') \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = cteCap cte'))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' x (ctes_of s) \<subseteq> descendants_of' x (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> (x = sl \<longrightarrow> \<not> isUntypedCap cap) \<and> (x \<noteq> sl \<longrightarrow> (\<forall>cte cte'. ctes_of s x = Some cte \<and> ctes_of s x = Some cte' \<longrightarrow> isUntypedCap (cteCap cte) = isUntypedCap (cteCap cte') \<and> capRange (cteCap cte) = capRange (cteCap cte') \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = cteCap cte')))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' x (ctes_of s) \<subseteq> descendants_of' x (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> x \<noteq> sl \<longrightarrow> (\<forall>cte cte'. ctes_of s x = Some cte \<and> ctes_of s x = Some cte' \<longrightarrow> isUntypedCap (cteCap cte) = isUntypedCap (cteCap cte') \<and> capRange (cteCap cte) = capRange (cteCap cte') \<and> (isUntypedCap (cteCap cte) \<longrightarrow> cteCap cte = cteCap cte'))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' x (ctes_of s) \<subseteq> descendants_of' x (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' x (ctes_of s) \<subseteq> descendants_of' x (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' x (ctes_of s) \<subseteq> descendants_of' x ((ctes_of s)(sl \<mapsto> cteCap_update (\<lambda>_. cap) (CTE x1 x2)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (11 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> \<exists>cte'. ctes_of s xa = Some cte' \<and> capMasterCap (cteCap cte') \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap cte') (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 4. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 10. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
A total of 11 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> vmdb (?m830 s x1 x2 x xa)
 2. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ?m830 s x1 x2 x xa (?slot830 s x1 x2 x xa) = Some (?cte830 s x1 x2 x xa)
 3. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> isFinal (cteCap (?cte830 s x1 x2 x xa)) (?slot830 s x1 x2 x xa) (map_option cteCap \<circ> ?m830 s x1 x2 x xa)
 4. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> final_matters' (cteCap (?cte830 s x1 x2 x xa)) \<and> \<not> isIRQHandlerCap (cteCap (?cte830 s x1 x2 x xa))
 5. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ?m830 s x1 x2 x xa \<turnstile> ?x830 s x1 x2 x xa \<rightarrow> ?slot830 s x1 x2 x xa
 6. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ?m830 s x1 x2 x xa (?x830 s x1 x2 x xa) = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (?cte830 s x1 x2 x xa))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 9. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 10. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ctes_of s (?slot830 s x1 x2 x xa) = Some (?cte830 s x1 x2 x xa)
 2. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> isFinal (cteCap (?cte830 s x1 x2 x xa)) (?slot830 s x1 x2 x xa) (map_option cteCap \<circ> ctes_of s)
 3. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> final_matters' (cteCap (?cte830 s x1 x2 x xa)) \<and> \<not> isIRQHandlerCap (cteCap (?cte830 s x1 x2 x xa))
 4. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> ?x830 s x1 x2 x xa \<rightarrow> ?slot830 s x1 x2 x xa
 5. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ctes_of s (?x830 s x1 x2 x xa) = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (?cte830 s x1 x2 x xa))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 8. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 10. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> isFinal (cteCap (CTE x1 x2)) sl (map_option cteCap \<circ> ctes_of s)
 2. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> final_matters' (cteCap (CTE x1 x2)) \<and> \<not> isIRQHandlerCap (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> ?x830 s x1 x2 x xa \<rightarrow> sl
 4. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ctes_of s (?x830 s x1 x2 x xa) = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 7. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 10. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> final_matters' (cteCap (CTE x1 x2)) \<and> \<not> isIRQHandlerCap (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> ?x830 s x1 x2 x xa \<rightarrow> sl
 3. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ctes_of s (?x830 s x1 x2 x xa) = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 6. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 10. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x1 x2 x xa. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False\<rbrakk> \<Longrightarrow> ctes_of s \<turnstile> ?x830 s x1 x2 x xa \<rightarrow> sl
 2. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ctes_of s (?x830 s x1 x2 x xa) = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 5. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 10. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s x1 x2 x xa xb. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s \<turnstile> xa \<rightarrow> sl; \<not> False; ctes_of s xa = Some xb \<and> isUntypedCap (cteCap xb) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> ctes_of s xa = Some xb \<and> capMasterCap (cteCap xb) \<noteq> capMasterCap (cteCap (CTE x1 x2)) \<and> global.sameRegionAs (cteCap xb) (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 4. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 9. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 10. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> ctes_of s sl = Some (CTE x1 x2)
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 3. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 8. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 9. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 10. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (9 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie cap \<or> isCNodeCap cap \<or> isThreadCap cap
 2. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 7. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 8. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 9. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s x1 x2 x xa cte'. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; ctes_of s xa = Some cte'; xa \<noteq> sl; False\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap cte') \<or> capClass (cteCap cte') \<noteq> PhysicalClass \<or> global.capUntypedPtr (cteCap cte') \<noteq> global.capUntypedPtr (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 6. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 7. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 8. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capRange (cteCap (CTE x1 x2)) = capRange cap \<and> global.capUntypedPtr (cteCap (CTE x1 x2)) = global.capUntypedPtr cap
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 5. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 6. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 7. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> capAligned (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 6. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> valid_cap' (cteCap (CTE x1 x2)) (?s881 s x1 x2 x)
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 4. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 6. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> isZombie (cteCap (CTE x1 x2)) \<or> isCNodeCap (cteCap (CTE x1 x2)) \<or> isThreadCap (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 3. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> no_loops (ctes_of s)
 2. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 x. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> descendants_of' sl (ctes_of s) = {}
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; (untyped_inc' (ctes_of s) \<longrightarrow> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))) \<and> (untyped_mdb' (ctes_of s) \<longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))))\<rbrakk> \<Longrightarrow> untyped_mdb' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> untyped_inc' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> valid_nullcaps (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> ut_revocable' (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> class_links (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> distinct_zombies (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> irq_control (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) \<and> reply_masters_rvk_fb (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap)))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_nullcaps ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> ut_revocable' ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> class_links ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> distinct_zombies ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> ut_revocable' ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> class_links ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> distinct_zombies ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> class_links ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> distinct_zombies ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> distinct_zombies ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (8 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> isUntypedCap (cteCap (CTE x1 x2)) \<longrightarrow> isUntypedCap (cteCap (CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> isArchPageCap (cteCap (CTE x1 x2)) \<longrightarrow> isArchPageCap (cteCap (CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capClass (cteCap (CTE cap x2)) = capClass (cteCap (CTE x1 x2))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capBits (cteCap (CTE cap x2)) = capBits (cteCap (CTE x1 x2))
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> global.capUntypedPtr (cteCap (CTE cap x2)) = global.capUntypedPtr (cteCap (CTE x1 x2))
 6. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 7. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 8. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (7 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> isArchPageCap (cteCap (CTE x1 x2)) \<longrightarrow> isArchPageCap (cteCap (CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capClass (cteCap (CTE cap x2)) = capClass (cteCap (CTE x1 x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capBits (cteCap (CTE cap x2)) = capBits (cteCap (CTE x1 x2))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> global.capUntypedPtr (cteCap (CTE cap x2)) = global.capUntypedPtr (cteCap (CTE x1 x2))
 5. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 6. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 7. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (6 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capClass (cteCap (CTE cap x2)) = capClass (cteCap (CTE x1 x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capBits (cteCap (CTE cap x2)) = capBits (cteCap (CTE x1 x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> global.capUntypedPtr (cteCap (CTE cap x2)) = global.capUntypedPtr (cteCap (CTE x1 x2))
 4. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 6. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (5 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> capBits (cteCap (CTE cap x2)) = capBits (cteCap (CTE x1 x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> global.capUntypedPtr (cteCap (CTE cap x2)) = global.capUntypedPtr (cteCap (CTE x1 x2))
 3. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 5. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> global.capUntypedPtr (cteCap (CTE cap x2)) = global.capUntypedPtr (cteCap (CTE x1 x2))
 2. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie (cteCap (CTE cap x2)); \<not> isZombie (cteCap (CTE x1 x2)); \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr (cteCap (CTE x1 x2)); capBits (cteCap cte'') = capBits (cteCap (CTE x1 x2))\<rbrakk> \<Longrightarrow> False
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2 y cte''. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); ctes_of s y = Some cte''; sl \<noteq> y; isZombie cap; \<not> isZombie x1; \<not> isZombie (cteCap cte''); \<not> isUntypedCap (cteCap cte''); \<not> isArchPageCap (cteCap cte''); capClass (cteCap cte'') = PhysicalClass; global.capUntypedPtr (cteCap cte'') = global.capUntypedPtr cap; capBits (cteCap cte'') = capBits cap\<rbrakk> \<Longrightarrow> valid_cap' x1 s
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2)) \<and> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (4 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s); cap \<noteq> capability.IRQControlCap\<rbrakk> \<Longrightarrow> irq_control ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> cap \<noteq> capability.IRQControlCap
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 4. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (3 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> cap \<noteq> capability.IRQControlCap
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 3. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> reply_masters_rvk_fb ((ctes_of s)(sl \<mapsto> CTE cap x2))
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); untyped_inc' ((ctes_of s)(sl \<mapsto> CTE cap x2)); untyped_mdb' ((ctes_of s)(sl \<mapsto> CTE cap x2)); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s)\<rbrakk> \<Longrightarrow> \<forall>cte. Some (CTE cap x2) = Some cte \<longrightarrow> isReplyCap (cteCap cte) \<and> capReplyMaster (cteCap cte) \<longrightarrow> mdbRevocable (cteMDBNode cte) \<and> mdbFirstBadged (cteMDBNode cte)
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; valid_dlist (ctes_of s) \<and> no_0 (ctes_of s) \<and> mdb_chain_0 (ctes_of s) \<and> valid_badges (ctes_of s) \<and> caps_contained' (ctes_of s) \<and> mdb_chunked (ctes_of s) \<and> untyped_mdb' (ctes_of s) \<and> untyped_inc' (ctes_of s) \<and> valid_nullcaps (ctes_of s) \<and> ut_revocable' (ctes_of s) \<and> class_links (ctes_of s) \<and> distinct_zombies (ctes_of s) \<and> irq_control (ctes_of s) \<and> reply_masters_rvk_fb (ctes_of s); sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s\<rbrakk> \<Longrightarrow> mdb_chunked (modify_map (ctes_of s) sl (cteCap_update (\<lambda>_. cap))) proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); mdb_chunked (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> mdb_chunked ((ctes_of s)(sl \<mapsto> CTE cap x2)) proof (prove)
goal (2 subgoals):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> isFinal x1 sl (map_option cteCap \<circ> ctes_of s)
 2. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_cap' x1 s proof (prove)
goal (1 subgoal):
 1. \<And>s x1 x2. \<lbrakk>valid_objs' s; pspace_aligned' s; pspace_distinct' s; no_0_obj' s; sch_act_wf (ksSchedulerAction s) s; Invariants_H.valid_queues s; sym_refs (state_refs_of' s); if_live_then_nonz_cap' s; if_unsafe_then_cap' s; valid_idle' s; valid_global_refs' s; valid_arch_state' s; valid_irq_node' (irq_node' s) s; \<forall>cap\<in>ran (cteCaps_of s). \<forall>irq. cap = capability.IRQHandlerCap irq \<longrightarrow> intStateIRQTable (ksInterruptState s) irq = irqstate.IRQSignal; valid_irq_states' s; valid_machine_state' s; irqs_masked' s; valid_queues' s; ct_not_inQ s; ct_idle_or_in_cur_domain' s; valid_pde_mappings' s; pspace_domain_valid s; ksCurDomain s \<le> maxDomain; ksDomSchedule (KernelInit_H.newKernelState undefined) \<noteq> []; \<forall>x\<in>set (ksDomSchedule (KernelInit_H.newKernelState undefined)). dschDomain x \<le> maxDomain \<and> 0 < dschLength x; ksDomSchedule s = ksDomSchedule (KernelInit_H.newKernelState undefined); ksDomScheduleIdx s < length (ksDomSchedule (KernelInit_H.newKernelState undefined)); untyped_ranges_zero' s; cur_tcb' s; valid_cap' cap s; isFinal x1 sl (cteCaps_of s); ctes_of s sl = Some (CTE x1 x2); capClass x1 = PhysicalClass; global.capUntypedPtr x1 = global.capUntypedPtr cap; capBits x1 = capBits cap; \<forall>r\<in>cte_refs' x1 (irq_node' s) - cte_refs' cap (irq_node' s). \<exists>cte. ctes_of s r = Some cte \<and> cteCap cte = capability.NullCap; isCNodeCap cap \<or> isThreadCap cap \<or> isZombie cap; final_matters' x1; isCNodeCap x1 \<or> isThreadCap x1 \<or> isZombie x1; \<not> isUntypedCap x1; \<forall>p\<in>threadCapRefs x1. st_tcb_at' ((=) Structures_H.thread_state.Inactive) p s \<and> bound_tcb_at' ((=) None) p s \<and> obj_at' (Not \<circ> tcbQueued) p s \<and> (\<forall>a b. p \<notin> set (ksReadyQueues s (a, b))); capClass cap = PhysicalClass; capRange x1 = capRange cap; valid_mdb' s; valid_dlist (ctes_of s); no_0 (ctes_of s); mdb_chain_0 (ctes_of s); valid_badges (ctes_of s); caps_contained' (ctes_of s); untyped_mdb' (ctes_of s); untyped_inc' (ctes_of s); valid_nullcaps (ctes_of s); ut_revocable' (ctes_of s); class_links (ctes_of s); distinct_zombies (ctes_of s); irq_control (ctes_of s); reply_masters_rvk_fb (ctes_of s)\<rbrakk> \<Longrightarrow> valid_cap' x1 s proof (prove)
goal:
No subgoals!